Menu
Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.
Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ubuntu1804-v220-1-1-1-3La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.
Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.
Basé sur la classification professionnelle SOC
Affichage de SKILL.md
| name | cis-ubuntu1804-v220-1-1-1-3 |
| description | Ensure mounting of jffs2 filesystems is disabled |
| category | cis-storage |
| version | 2.2.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-18.04","filesystem","jffs2","kernel-module"] |
| cis_id | 1.1.1.3 |
| cis_benchmark | CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Level 1 - Server / Level 1 - Workstation, Assessment: Automated
The jffs2 (journaling flash filesystem 2) filesystem type is a log-structured filesystem used in flash memory devices.
Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.
None noted.
Run the following script to verify the jffs2 module is disabled. If the module is available in the running kernel:
/bin/true or /bin/false exists in a file within the /etc/modprobe.d/ directory/etc/modprobe.d/ directoryIf available in ANY installed kernel:
/etc/modprobe.d/ directory#!/usr/bin/env bash
{
l_output="" l_output2="" l_output3="" l_dl=""
l_mname="jffs2"
l_mtype="fs"
l_searchloc="/lib/modprobe.d/*.conf /usr/local/lib/modprobe.d/*.conf /run/modprobe.d/*.conf /etc/modprobe.d/*.conf"
l_mpath="/lib/modules/**/kernel/$l_mtype"
l_mpname="$(tr '-' ' ' <<< "$l_mname")"
l_mndir="$(tr '-' '/' <<< "$l_mname")"
module_loadable_chk()
{
l_loadable="$(modprobe -n -v "$l_mname")"
[ "$(wc -l <<< "")" -gt ] && l_loadable=
grep -Pq -- <<< ;
l_output=
l_output2=
}
()
{
! lsmod | grep > /dev/null 2>&1;
l_output=
l_output2=
}
()
{
l_dl=
modprobe --showconfig | grep -Pq -- ;
l_output=
l_output2=
}
l_mdir ;
[ -d ] && [ -n ];
l_output3=
[ != ] && module_deny_chk
[ = ];
module_loadable_chk
module_loaded_chk
l_output=
[ -n ] && -e
[ -z ];
-e
-e
[ -n ] && -e
}
If the module is available in the running kernel:
install jffs2 /bin/false in the /etc/modprobe.d/ directoryblacklist jffs2 in the /etc/modprobe.d/ directoryIf available in ANY installed kernel:
blacklist jffs2 in the /etc/modprobe.d/ directoryIf the kernel module is not available on the system or pre-compiled into the kernel:
#!/usr/bin/env bash
{
l_mname="jffs2"
l_mtype="fs"
l_mpath="/lib/modules/**/kernel/$l_mtype"
l_mpname="$(tr '-' ' ' <<< "$l_mname")"
l_mndir="$(tr '-' '/' <<< "$l_mname")"
module_loadable_fix()
{
l_loadable="$(modprobe -n -v "$l_mname")"
[ "$(wc -l <<< "$l_loadable")" -gt "1" ] && l_loadable="$(grep -P -- "(^\h*install|\b$l_mname)\b" <<< "$l_loadable")"
if ! grep -Pq -- '^\h*install \/bin\/(true|false)' <<< "$l_loadable"; then
echo -e "\n - setting module: \"$l_mname\" to be not loadable"
echo -e "install $l_mname /bin/false" >> /etc/modprobe.d/"$l_mpname".conf
fi
}
module_loaded_fix()
{
if lsmod | grep "$l_mname" > /dev/null 2>&1; then
echo -e "\n - unloading module \"$l_mname\""
modprobe -r "$l_mname"
fi
}
module_deny_fix()
{
if ! modprobe --showconfig | grep -Pq -- "^\h*blacklist\h+$l_mpname\b"; then
echo -e "\n - deny listing \"$l_mname\""
echo -e "blacklist $l_mname" >> /etc/modprobe.d/"$l_mpname".conf
fi
}
for l_mdir in $l_mpath; do
if [ -d "$l_mdir/$l_mndir" ] && [ -n "$(ls -A $l_mdir/$l_mndir)" ]; then
echo -e "\n - module: \"$l_mname\" exists in \"$l_mdir\"\n - checking if disabled..."
module_deny_fix
if [ "$l_mdir" = "/lib/modules/$(uname -r)/kernel/$l_mtype" ]; then
module_loadable_fix
module_loaded_fix
fi
else
echo -e "\n - module: \"$l_mname\" doesn't exist in \"$l_mdir\"\n"
fi
done
echo -e "\n - remediation of module: \"$l_mname\" complete\n"
}
Not disabled by default.
v8 - 4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software (IG 2, IG 3) v7 - 9.2 Ensure Only Approved Ports, Protocols and Services Are Running (IG 2, IG 3)
MITRE ATT&CK Mappings: T1005, T1005.000 (TA0005) - M1050