Ensure firewire-core kernel module is not available

점검 방법

감사 방식: 셸 명령

m=firewire-core; found=$(find /lib/modules/$(uname -r)/kernel /usr/lib/modules/$(uname -r)/kernel -path "*/firewire/core*" 2>/dev/null | head -n1); if [ -z "$found" ]; then echo compliant; exit 0; fi; lsmod | awk '{print $1}' | grep -Fxq -- "${m//-/_}" && { echo "$m is loaded"; exit 0; }; cfg=$(modprobe --showconfig 2>/dev/null); printf '%s\n' "$cfg" | grep -Pq -- "^\h*blacklist\h+${m//-/_}\b" || { echo "$m is not blacklisted"; exit 0; }; printf '%s\n' "$cfg" | grep -Pq -- "^\h*install\h+${m//-/_}\h+(/usr)?/bin/(true|false)\b" || { echo "$m install is not disabled"; exit 0; }; echo compliant

예상 출력

compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Unload and disable the firewire-core kernel module. 1. Run the following commands to unload the firewire-core kernel module: # modprobe -r firewire-core 2>/dev/null # rmmod firewire-core 2>/dev/null 2. Perform the following to disable the firewire-core kernel module: Create a file ending in .conf with install firewire-core /bin/false in the /etc/modprobe.d/ directory Example: # printf '%s\n' "" "install firewire-core /bin/false" >> /etc/modprobe.d/60- firewire-core.conf Create a file ending in .conf with blacklist firewire-core in the /etc/modprobe.d/ directory Example: # printf '%s\n' "" "blacklist firewire-core" >> /etc/modprobe.d/60-firewire- core.conf

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

tmaegis scan --target linux