Ensure unused filesystems kernel modules are not available

보통레벨 1수동 검토azure-container-linux

설명

Filesystem kernel modules are pieces of code that can be dynamically loaded into the Linux kernel to extend its filesystem capabilities, or so-called base kernel, of an operating system. Filesystem kernel modules are typically used to add support for new hardware (as device drivers), or for adding system calls. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Verify filesystem kernel modules that are not in use on the system are disabled. Review currently loaded kernel modules to ensure they are needed and conform to local site policy. Note: The "Audit script" included at the bottom of the "Audit Procedure" will perform the steps included below. 1. Run the following command to generate a list of filesystem types currently mounted on the system. # findmnt -Dkerno fstype | sort -u Review the output. These filesystem types should either be excluded from the audit or if no longer needed, unmounted and disabled. ...

조치 방법

조치 방식: 가이드 또는 인프라 패치

- IF - the module is available in the running kernel: • Unload the filesystem kernel module from the kernel • Create a file ending in .conf with install filesystem kernel modules /bin/false in the /etc/modprobe.d/ directory • Create a file ending in .conf with deny list filesystem kernel modules in the /etc/modprobe.d/ directory WARNING: unloading, disabling or denylisting filesystem modules that are in use on the system may be FATAL. It is extremely important to thoroughly review the filesystems returned by the audit before following the remediation procedure. ...

속성

운영 체제: 모두
태그: azure-container-linuxmanual-review
참고 자료: CIS Azure Container Linux Benchmark v1.0.0 - 1.1.1.7 Ensure unused filesystems kernel modules are not available