# Ensure hfsplus kernel module is not available

Necessity: The 'hfsplus' kernel module provides support for the Hierarchical File System Plus, which is used by Apple macOS. Disabling unused kernel modules is a critical security best practice that reduces the system's attack surface. If the system does not need to interact with HFS+ formatted devices, the module should be disabled. A vulnerability within this driver could be exploited by a malicious actor, potentially leading to kernel-level code execution and a complete system compromise. Auditing and Remediation: The audit script verifies that the system's modprobe configuration is set to prevent the 'hfsplus' module from being loaded. The remediation script enforces this security measure by creating a specific modprobe configuration file to blacklist the module and ensures it is unloaded from the currently running kernel. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Disabled'. This control is binary; the module is either needed or it is not. For any system not explicitly requiring HFS+ support, the module introduces unnecessary risk. Therefore, disabling it aligns with the principle of least functionality, which is a foundational concept for all levels of system hardening.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'hfsplus' kernel module is prevented from being loaded. The script must inspect the modprobe configuration by running 'modprobe --showconfig' and checking for the line 'install hfsplus /bin/true'. If this configuration is present, the script must return the string 'Disabled'. If the module is not configured this way, it must return 'Enabled'. The output must only be the string 'Disabled' or 'Enabled' with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument to set the state of the 'hfsplus' kernel module. If the argument is 'Disabled', the script must create a configuration file in '/etc/modprobe.d/' containing 'install hfsplus /bin/true' and unload the module from the running kernel using 'rmmod hfsplus'. The script must return 'true' on success and 'false' on failure.

