cis-ubuntu1804-v220-1-1-1-5

name	cis-ubuntu1804-v220-1-1-1-5
description	Ensure mounting of hfsplus filesystems is disabled
category	cis-storage
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","filesystem","hfsplus","kernel-module"]
cis_id	1.1.1.5
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure mounting of hfsplus filesystems is disabled

Profile

Level 1 - Server / Level 1 - Workstation, Assessment: Automated

Description

The hfsplus filesystem type is a hierarchical filesystem designed to replace hfs that allows you to mount Mac OS filesystems.

Rationale

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

Impact

None noted.

Audit Procedure

Command Line

Run the following script to verify the hfsplus module is disabled. If the module is available in the running kernel:

• An entry including /bin/true or /bin/false exists in a file within the /etc/modprobe.d/ directory
• The module is deny listed in a file within the /etc/modprobe.d/ directory
• The module is not loaded in the kernel

#!/usr/bin/env bash
{
    l_output="" l_output2="" l_output3="" l_dl=""
    l_mname="hfsplus"
    l_mtype="fs"
    l_searchloc="/lib/modprobe.d/*.conf /usr/local/lib/modprobe.d/*.conf /run/modprobe.d/*.conf /etc/modprobe.d/*.conf"
    l_mpath="/lib/modules/**/kernel/$l_mtype"
    l_mpname="$(tr '-' ' ' <<< "$l_mname")"
    l_mndir="$(tr '-' '/' <<< "$l_mname")"
    module_loadable_chk()
    {
        l_loadable="$(modprobe -n -v "$l_mname")"
        [ "$(wc -l <<< "$l_loadable")" -gt "1" ] && l_loadable=""
         grep -Pq --  <<< ; 
            l_output=
        
            l_output2=
        
    }
    ()
    {
         ! lsmod | grep  > /dev/null 2>&1; 
            l_output=
        
            l_output2=
        
    }
    ()
    {
        l_dl=
         modprobe --showconfig | grep -Pq -- ; 
            l_output=
        
            l_output2=
        
    }
     l_mdir  ; 
         [ -d  ] && [ -n  ]; 
            l_output3=
            [  !=  ] && module_deny_chk
             [  =  ]; 
                module_loadable_chk
                module_loaded_chk
            
        
            l_output=
        
    
    [ -n  ] &&  -e 
     [ -z  ]; 
         -e 
    
         -e 
        [ -n  ] &&  -e 
    
}