# Ensure overlayfs kernel module is not available

Necessity: The 'overlayfs' kernel module implements a union mount filesystem, commonly used by container technologies like Docker. It has been the subject of several high-severity security vulnerabilities (e.g., CVE-2021-3493, CVE-2023-0386) that can lead to local privilege escalation. Disabling 'overlayfs' on systems that do not require it for containerization significantly reduces the kernel's attack surface, mitigating the risk of exploitation by a local attacker. Leaving it enabled on a system without a clear need exposes the system to unnecessary risk.

Auditing and Remediation: The audit script checks the system's modprobe configuration to determine if loading of the 'overlayfs' module is prevented. The remediation script modifies this configuration by creating a file in '/etc/modprobe.d/' with the rule 'install overlayfs /bin/true'. This rule effectively tells the kernel to run the command '/bin/true' (which does nothing and succeeds) instead of loading the module, thus disabling it. The script also unloads the module if it's already active.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Disabled'. This is a binary security control; the module is either available or it is not. Given the history of critical vulnerabilities associated with 'overlayfs', the most prudent security posture is to disable it unless there is an explicit operational requirement, such as running containers. This single recommendation provides the maximum security benefit by eliminating a known vector for privilege escalation attacks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script to check if the 'overlayfs' kernel module is disabled. The script must query the modprobe configuration for 'overlayfs' (e.g., by running 'modprobe -n -v overlayfs'). If the output indicates the module is set to be ignored (e.g., 'install /bin/true'), the script must return the string 'Disabled'. Otherwise, it should return 'Enabled'. The script must only output the resulting string and nothing else.

## Remediation Script Working

Bash script that accepts one positional argument ('Enabled' or 'Disabled') to configure the 'overlayfs' kernel module. If the argument is 'Disabled', the script must create a file in '/etc/modprobe.d/' with the content 'install overlayfs /bin/true' and unload the module using 'rmmod' if it is currently loaded. If the argument is 'Enabled', it must remove that configuration file. The script must return 'true' on success or 'false' on failure.

