Detections
Analytics

1.1.1.1 Ensure ext2fs kernel module is not available

Information

The ext2fs filesystem module is used for reading or writing the traditional Linux filesystems like ext2 / ext3 / ext4.

Removing support for unneeded filesystem types reduces the local attack surface of the system. This module should be required only to temporarily read/write to ext2 / ext3 / ext4 filesystems. If this filesystem type is not needed, disable it.

Solution

Run the following script to disable the ext2fs module:

-IF- the module is available in the running kernel:

 - Disable loading the kernel module
 - Unload ext2fs from the kernel

# kldunload -f ext2fs
# printf "ext2fs_load=\"NO\"\n" >> /boot/loader.conf

See Also

https://workbench.cisecurity.org/benchmarks/19044

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 37dfaa2e9bf4246d853bb4b353e8a2f3314e9515776593ea9f81d5e25bc681c2