Detections
Analytics

1.1.1.3 Ensure zfs kernel module is not available

Information

The zfs filesystem is a highly scalable filesystem used in FreeBSD for larger systems with huge disk spaces.

Removing support for unneeded filesystem types reduces the local attack surface of the system. This module is only required when ZFS storage systems are used, or FreeBSD has been installed in ZFS partitions. Disable the module if the system is an embedded device or smaller subsystem that does not use ZFS.

Solution

Run the following script to disable the zfs module:

-IF- the module is available in the running kernel:

 - Stop the zfs service
 - Disable the zfs service
 - Disable loading the kernel module
 - Unload zfs from the kernel

# service zfs stop
# sysrc zfs_enable="NO"
# kldunload -f zfs
# printf "zfs_load=\"NO\"\n" >> /boot/loader.conf

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 60c62d80b305a842d333a42e99cd99cd43238f27350b8e9420c9f851175cfe0a