TMA-ROCKY8-3.2.3

Ensure dccp kernel module is not available

中レベル 1自動linux

説明

The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol that supports streaming media and telephony. DCCP provides a way to gain access to congestion control, without having to do it at the application layer, but does not provide in-sequence delivery.

チェック方法

監査方法: シェルコマンド

shell

m=dccp; found=$(find /lib/modules/$(uname -r)/kernel /usr/lib/modules/$(uname -r)/kernel -path "*/dccp*" 2>/dev/null | head -n1); if [ -z "$found" ]; then echo compliant; exit 0; fi; lsmod | awk '{print $1}' | grep -Fxq -- "${m//-/_}" && { echo "$m is loaded"; exit 0; }; cfg=$(modprobe --showconfig 2>/dev/null); printf '%s\n' "$cfg" | grep -Pq -- "^\h*blacklist\h+${m//-/_}\b" || { echo "$m is not blacklisted"; exit 0; }; printf '%s\n' "$cfg" | grep -Pq -- "^\h*install\h+${m//-/_}\h+(/usr)?/bin/(true|false)\b" || { echo "$m install is not disabled"; exit 0; }; echo compliant

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Unload and disable the dccp kernel module. 1. Run the following commands to unload the dccp kernel module: # modprobe -r dccp 2>/dev/null # rmmod dccp 2>/dev/null 2. Perform the following to disable the dccp kernel module: Create a file ending in .conf with install dccp /bin/false in the /etc/modprobe.d/ directory Example: # printf '\n%s\n' "install dccp /bin/false" >> /etc/modprobe.d/60-dccp.conf Create a file ending in .conf with blacklist dccp in the /etc/modprobe.d/ directory Example: # printf '\n%s\n' "blacklist dccp" >> /etc/modprobe.d/60-dccp.conf

プロパティ

オペレーティングシステム: rocky-8
タグ: cis-convertedkernellinuxmodules
参照: CIS Rocky Linux 8 Benchmark v3.0.0 - 3.2.3

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target linux