cis-ubuntu1804-v220-3-2-2

name	cis-ubuntu1804-v220-3-2-2
description	Ensure tipc kernel module is not available
category	cis-networking
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","networking","kernel-module"]
cis_id	3.2.2
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0 - Control 3.2.2

Description

The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes.

Rationale

If the protocol is not being used, it is recommended that the kernel module drivers not be installed to reduce the potential attack surface.

Impact

None.

Audit Procedure

Command Line

Run the following script to verify the tipc module is not available:

#!/usr/bin/bash
{
  l_mname="tipc"
  l_mtype="net"
  l_output="" l_output2="" l_output3=""

  l_loadable="$(modprobe -n -v "$l_mname")"
  [ "$(wc -l <<< "$l_loadable")" -gt "1" ] && l_loadable="$(grep -P -- "(^\h*install|\b$l_mname)\b" <<< "$l_loadable")"
  if grep -Pq -- '^\h*install \/bin\/(true|false)' <<< "$l_loadable"; then
    l_output="$l_output\n - module: \"$l_mname\" is not loadable: \"$l_loadable\""
  else
    l_output2="$l_output2\n - module: \"$l_mname\" is loadable: \"$l_loadable\""
  fi

  if ! lsmod | grep "$l_mname" > /dev/null 2>&1; then
    l_output="\n - module: \"\" is not loaded"
  
    l_output2=
  

   modprobe --showconfig | grep -Pq -- ; 
    l_output=
  
    l_output2=
  

   [ -z  ]; 
     -e 
  
     -e 
    [ -n  ] &&  -e 
  
}