# Ensure tipc kernel module is not available

The Transparent Inter-Process Communication (TIPC) protocol is a specialized protocol designed for communication within computer clusters. Disabling kernel modules that are not required for system operation is a critical security best practice that reduces the overall attack surface of the kernel. If the system is not part of a cluster that explicitly uses the TIPC protocol, the module provides no benefit and its presence could expose the system to potential vulnerabilities within the module's code, which could be exploited for privilege escalation or denial of service attacks. The audit script verifies that the 'tipc' module is not currently loaded into the kernel and that a modprobe configuration is in place to prevent it from loading. The remediation script enforces this state by unloading the module if present and creating the necessary configuration file to make the change persistent. All recommended states (Basic, Moderate, and Strict) are set to 'Disabled' because this is a binary control. The module is either required for a specific function or it is not. For any general-purpose system that does not have a documented need for TIPC, disabling it is the only secure recommendation, aligning with the principle of least functionality.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script to verify that the 'tipc' kernel module is disabled. The script should check if the module is currently loaded using `lsmod` and if it is configured to be prevented from loading via modprobe settings. The script must return only the string 'Disabled' if the module is both not loaded and configured to be disabled, and 'Enabled' otherwise, with no extra text.

## Remediation Script Working

bash script that accepts one argument: the desired state. If the argument is 'Disabled', the script should unload the 'tipc' kernel module if it is currently loaded using `rmmod` and then create a modprobe configuration file (`/etc/modprobe.d/tipc.conf`) to prevent it from being loaded in the future. The script must return 'true' on success and 'false' on failure.

