Detections
Analytics

1.1.1.7 Ensure squashfs kernel module is not available

Information

The squashfs filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems. A squashfs image can be used without having to first decompress the image.

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

Solution

Unload and disable the squashfs kernel module.

 - Run the following commands to unload the squashfs kernel module:

# modprobe -r squashfs 2>/dev/null
# rmmod squashfs 2>/dev/null

 - Perform the following to disable the squashfs kernel module:

Create a file ending in .conf with install squashfs /bin/false in the /etc/modprobe.d/ directory.

Example:

# printf '%s\n' "" "install squashfs /bin/false" >> /etc/modprobe.d/60-squashfs.conf

Create a file ending in .conf with blacklist squashfs in the /etc/modprobe.d/ directory.

Example:

# printf '%s\n' "" "blacklist squashfs" >> /etc/modprobe.d/60-squashfs.conf

Impact:

WARNING: squashfs is used by Snap packages and by some live/installer media and container images. Disabling it may break snap applications and those workflows. Confirm none are in use before disabling.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: a2ad85e5e1f084d96073b6edb8a53ff1288102439ab54a752e19f80fc6a5d6c1