Disable Mounting of squashfs

Classification:

compliance

Framework:

Control:

Description

To configure the system to prevent the squashfs kernel module from being loaded, add the following line to the file /etc/modprobe.d/squashfs.conf:

install squashfs /bin/true

This effectively prevents usage of this uncommon filesystem.

The squashfs filesystem type is a compressed read-only Linux filesystem embedded in small footprint systems (similar to cramfs). A squashfs image can be used without having to first decompress the image.

Rationale

Removing support for unneeded filesystem types reduces the local attack surface of the system.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if LC\_ALL=C grep -q -m 1 "^install squashfs" /etc/modprobe.d/squashfs.conf ; then
 
 sed -i 's#^install squashfs.\*#install squashfs /bin/true#g' /etc/modprobe.d/squashfs.conf
else
 echo -e "\n# Disable per security requirements" >> /etc/modprobe.d/squashfs.conf
 echo "install squashfs /bin/true" >> /etc/modprobe.d/squashfs.conf
fi

if ! LC\_ALL=C grep -q -m 1 "^blacklist squashfs$" /etc/modprobe.d/squashfs.conf ; then
 echo "blacklist squashfs" >> /etc/modprobe.d/squashfs.conf
fi

else
 >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Ensure kernel module 'squashfs' is disabled
 lineinfile:
 create: true
 dest: /etc/modprobe.d/squashfs.conf
 regexp: install\s+squashfs
 line: install squashfs /bin/true
 when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-83855-7
 - NIST-800-171-3.4.6
 - NIST-800-53-CM-6(a)
 - NIST-800-53-CM-7(a)
 - NIST-800-53-CM-7(b)
 - disable\_strategy
 - kernel\_module\_squashfs\_disabled
 - low\_complexity
 - low\_severity
 - medium\_disruption
 - reboot\_required

- name: Ensure kernel module 'squashfs' is blacklisted
 lineinfile:
 create: true
 dest: /etc/modprobe.d/squashfs.conf
 regexp: ^blacklist squashfs$
 line: blacklist squashfs
 when: ansible\_virtualization\_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-83855-7
 - NIST-800-171-3.4.6
 - NIST-800-53-CM-6(a)
 - NIST-800-53-CM-7(a)
 - NIST-800-53-CM-7(b)
 - disable\_strategy
 - kernel\_module\_squashfs\_disabled
 - low\_complexity
 - low\_severity
 - medium\_disruption
 - reboot\_required