Ensure tipc kernel module is not available

檢查方式

稽核方法: Shell 指令

m=tipc; found=$(find /lib/modules/$(uname -r)/kernel /usr/lib/modules/$(uname -r)/kernel -path "*/tipc*" 2>/dev/null | head -n1); if [ -z "$found" ]; then echo compliant; exit 0; fi; lsmod | awk '{print $1}' | grep -Fxq -- "${m//-/_}" && { echo "$m is loaded"; exit 0; }; cfg=$(modprobe --showconfig 2>/dev/null); printf '%s\n' "$cfg" | grep -Pq -- "^\h*blacklist\h+${m//-/_}\b" || { echo "$m is not blacklisted"; exit 0; }; printf '%s\n' "$cfg" | grep -Pq -- "^\h*install\h+${m//-/_}\h+(/usr)?/bin/(true|false)\b" || { echo "$m install is not disabled"; exit 0; }; echo compliant

預期輸出

compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Run the following to unload and disable the tipc kernel module. This can also be done by running the script included below. Run the following commands to unload the tipc kernel module: # modprobe -r tipc 2>/dev/null # rmmod tipc 2>/dev/null Perform the following to disable the tipc kernel module: Create a file ending in .conf with install tipc /bin/false in the /etc/modprobe.d/ directory Example: # printf '\n%s\n' "install tipc /bin/false" >> tipc.conf Create a file ending in .conf with blacklist tipc in the /etc/modprobe.d/ directory Example: # printf '\n%s\n' "blacklist tipc" >> tipc.conf Optional remediation script: This script will perform the above remediation as required by the system …

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

tmaegis scan --target linux --level 2