cis-ubuntu1804-v220-1-1-1-2

name	cis-ubuntu1804-v220-1-1-1-2
description	Ensure mounting of freevxfs filesystems is disabled
category	cis-storage
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","filesystem","freevxfs","kernel-module"]
cis_id	1.1.1.2
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure mounting of freevxfs filesystems is disabled

Profile

Level 1 - Server / Level 1 - Workstation, Assessment: Automated

Description

The freevxfs filesystem type is a free version of the Veritas type filesystem. This is the primary filesystem type for HP-UX operating systems.

Rationale

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

Impact

None noted.

Audit Procedure

Command Line

Run the following script to verify the freevxfs module is disabled:

#!/usr/bin/env bash
{
    l_output="" l_output2="" l_output3="" l_dl=""
    l_mname="freevxfs"
    l_mtype="fs"
    l_searchloc="/lib/modprobe.d/*.conf /usr/local/lib/modprobe.d/*.conf /run/modprobe.d/*.conf /etc/modprobe.d/*.conf"
    l_mpath="/lib/modules/**/kernel/$l_mtype"
    l_mpname="$(tr '-' ' ' <<< "$l_mname")"
    l_mndir="$(tr '-' '/' <<< "$l_mname")"

    module_loadable_chk()
    {
        l_loadable="$(modprobe -n -v "$l_mname")"
        [ "$(wc -l <<< "$l_loadable")" -gt "1" ] && l_loadable="$(grep -P -- "(^\h*install|\b$l_mname)\b" <<< "$l_loadable")"
        if grep -Pq -- '^\h*install \/bin\/(true|false)' <<< ""; 
            l_output=
        
            l_output2=
        
    }
    ()
    {
         ! lsmod | grep  > /dev/null 2>&1; 
            l_output=
        
            l_output2=
        
    }
    ()
    {
        l_dl=
         modprobe --showconfig | grep -Pq -- ; 
            l_output=
        
            l_output2=
        
    }
     l_mdir  ; 
         [ -d  ] && [ -n  ]; 
            l_output3=
            [  !=  ] && module_deny_chk
             [  =  ]; 
                module_loadable_chk
                module_loaded_chk
            
        
            l_output=
        
    
    [ -n  ] &&  -e 
     [ -z  ]; 
         -e 
    
         -e 
        [ -n  ] &&  -e 
    
}