TMA-BOTTLEROCKET-1.1.1.1
Ensure mounting of udf filesystems is disabled
Description
The udf filesystem type is the universal disk format used to implement ISO/IEC 13346 and ECMA-167 specifications. This is an open vendor filesystem type for data storage on a broad range of media. This filesystem type is necessary to support writing DVDs and newer optical disc formats. The audit requires the udf module not to be loaded and blocked (modprobe -n -v shows install /bin/true, or apiclient settings.kernel.modules.udf.allowed is false). Run tmaegis on the host through the admin container root shell (sudo sheltie).
How it is checked
Audit method: Shell command
grep -qw '^udf' /proc/modules 2>/dev/null && { echo 'udf is loaded'; exit 1; }
o=$(modprobe -n -v udf 2>&1)
case "$o" in *'install /bin/true'*|*'install /bin/false'*) echo compliant; exit 0 ;; esac
a=$(apiclient get settings.kernel.modules.udf.allowed 2>/dev/null) || { echo 'udf can be loaded'; exit 1; }
printf '%s' "$a" | tr -d ' \n' | grep -q '"allowed":false' && echo compliant || echo 'udf is allowed'- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Run the following command to disable the udf module: # apiclient set kernel.modules.udf.allowed=false Run the following command to unload the udf module: # rmmod udf
Properties
- Operating systems
- Any
- Tags
- bottlerocketsystem
- Reference
- CIS Bottlerocket Benchmark v1.0.0 - 1.1.1.1 Ensure mounting of udf filesystems is disabled
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target bottlerocket --level 2