# Ensure overlayfs kernel module is not available

Necessity: The 'overlayfs' filesystem allows for the layering of multiple directory trees into a single, unified view. While essential for container technologies like Docker, it increases the kernel's attack surface. Vulnerabilities discovered in overlayfs have historically led to local privilege escalation exploits. Disabling this kernel module on systems that do not run containers reduces the potential for such attacks by adhering to the principle of least functionality.

Auditing and Remediation: The audit script verifies if the 'overlayfs' module is both unloaded from the current kernel session (checked via 'lsmod') and configured not to load on subsequent boots (checked via 'modprobe'). The remediation script enforces this state by creating a modprobe configuration file to blacklist the module and then attempts to unload it from the running system.

Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'disabled'. There is no secure configuration for this module other than disabling it on systems where it is not explicitly required. If the system's function does not depend on containerization or other technologies that use overlayfs, it should be disabled to minimize security risks. This is a binary choice; enabling it introduces a potential attack vector that is unnecessary on a non-container host.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'overlayfs' kernel module is disabled. The script should check if the module is currently loaded using 'lsmod' and verify its configuration using 'modprobe -n -v overlayfs'. If the module is not loaded and the configuration output is 'install /bin/true', the script should return the string 'disabled'. In all other cases, it should return 'enabled'. The output must contain only one of these two strings and nothing else.

## Remediation Script Working

Bash script that accepts a single positional command-line argument, which should be 'disabled'. The script must create a file in '/etc/modprobe.d/' containing 'install overlayfs /bin/true' to prevent the module from being loaded. It must also attempt to unload the module from the running kernel using 'rmmod overlayfs'. The script must return 'true' on successful completion or 'false' if it fails.

