Detections
Analytics

1.1.1.2 Ensure msdosfs kernel module is not available

Information

The msdosfs driver will permit the FreeBSD kernel to read and write MS-DOS based file systems.

Removing support for unneeded file system types reduces the local attack surface of the system. This module is required only when reading or writing from MS-DOS based filesystems such as FAT16 or FAT32 file systems. These types of file systems are used on flash and other memory cards but have mostly been replaced with NTFS on Microsoft systems. It is recommended that support for these file system types these be disabled.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Run the following script to disable the msdosfs module:

-IF- the module is available in the running kernel:

 - Disable loading the kernel module
 - Unload msdosfs from the kernel

# kldunload -f msdosfs
# printf "msdosfs_load=\"NO\"\n" >> /boot/loader.conf

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 41fc08070f8dac5f26d74bc1068b99b0e5516f976ff783093321a6077fbdebb6