Detections
Analytics

3.2.6 Ensure tipc kernel module is not available

Information

The Transparent Inter-Process Communication (TIPC) protocol is designed to provide communication between cluster nodes.

Removing support for unneeded protocols reduces the local attack surface of the system. If this protocol is not needed, disable it.

Solution

Unload and disable the tipc kernel module.

 - Run the following commands to unload the tipc kernel module:

# modprobe -r tipc 2>/dev/null
# rmmod tipc 2>/dev/null

 - Perform the following to disable the tipc kernel module:

Create a file ending in .conf with install tipc /bin/false in the /etc/modprobe.d/ directory

Example:

# printf '\n%s\n' "install tipc /bin/false" >> /etc/modprobe.d/60-tipc.conf

Create a file ending in .conf with blacklist tipc in the /etc/modprobe.d/ directory

Example:

# printf '\n%s\n' "blacklist tipc" >> /etc/modprobe.d/60-tipc.conf

See Also

https://workbench.cisecurity.org/benchmarks/26891

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, 800-53|CM-7a., CCI|CCI-000381, CSCv7|9.2, Rule-ID|SV-230497r1069313_rule, Rule-ID|SV-248832r958478_rule, Rule-ID|SV-257808r1044865_rule, Rule-ID|SV-269347r1050229_rule, Rule-ID|SV-271447r1092464_rule

Plugin: Unix

Control ID: abf234a668a0db5cea9c3b5efde2bc7f63c32bc0126fadd456c4e101b8aec3db