Disable Mounting of freevxfs

Classification:

compliance

Framework:

Control:

Description

To configure the system to prevent the freevxfs kernel module from being loaded, add the following line to the file /etc/modprobe.d/freevxfs.conf:

install freevxfs /bin/true

This effectively prevents usage of this uncommon filesystem.

Rationale

Linux kernel modules which implement filesystems that are not needed by the local system should be disabled.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC\_ALL=C grep -q -m 1 "^install freevxfs" /etc/modprobe.d/freevxfs.conf ; then
 
 sed -i 's#^install freevxfs.\*#install freevxfs /bin/true#g' /etc/modprobe.d/freevxfs.conf
else
 echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/freevxfs.conf
 echo "install freevxfs /bin/true" >> /etc/modprobe.d/freevxfs.conf
fi

else
 >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Ensure kernel module 'freevxfs' is disabled
 lineinfile:
 create: true
 dest: /etc/modprobe.d/freevxfs.conf
 regexp: install\s+freevxfs
 line: install freevxfs /bin/true
 when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - NIST-800-171-3.4.6
 - NIST-800-53-CM-6(a)
 - NIST-800-53-CM-7(a)
 - NIST-800-53-CM-7(b)
 - disable\_strategy
 - kernel\_module\_freevxfs\_disabled
 - low\_complexity
 - low\_severity
 - medium\_disruption
 - reboot\_required