# Ensure squashfs kernel module is not available

The 'squashfs' filesystem is a compressed, read-only filesystem typically used for live distributions and installers. On a production server, it is generally not required. Disabling unused kernel modules like 'squashfs' is a critical security best practice that reduces the kernel's attack surface. A vulnerability within this module could potentially be exploited for privilege escalation or system compromise. Adhering to the principle of least functionality by removing unneeded drivers minimizes these risks. The audit script verifies that the system is configured to prevent the 'squashfs' module from being loaded, checking for a specific modprobe configuration. The remediation script implements this configuration by creating a file in `/etc/modprobe.d/` to blacklist the module and also attempts to unload it from the running kernel. Since the module is either enabled or disabled, the recommended state for Basic, Moderate, and Strict security levels is consistently 'Disabled'. There is no benefit to leaving an unnecessary kernel module available for loading.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to check the status of the 'squashfs' kernel module. The script must inspect the configuration in `/etc/modprobe.d/` and the output of `modprobe -n -v squashfs`. If the module is configured to be disabled (e.g., via 'install squashfs /bin/true'), the script must return the string 'Disabled'. If it is not configured to be disabled, it must return 'Enabled'. The script's output must consist solely of the status string, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument: 'Enabled' or 'Disabled'. If the argument is 'Disabled', the script must create a configuration file in `/etc/modprobe.d/` containing 'install squashfs /bin/true' and then attempt to unload the module from the running kernel using `rmmod squashfs`. If the argument is 'Enabled', it must remove the corresponding configuration file. The script must output 'true' upon successful execution or 'false' if it fails.

