# Cis GCP Cos 1.1.1.1

> Ensure mounting of udf filesystems is disabled

- Skill: `cyberstrikeus/cis-gcp-cos-1-1-1-1` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-gcp-cos-1-1-1-1`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-gcp-cos-1-1-1-1/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-gcp-cos-1-1-1-1

---


# 1.1.1.1 Ensure mounting of udf filesystems is disabled (Automated)

## Description

The `udf` filesystem type is the universal disk format used to implement ISO/IEC 13346 and ECMA-167 specifications. This is an open vendor filesystem type for data storage on a broad range of media. This filesystem type is necessary to support writing DVDs and newer optical disc formats.

## Rationale

Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.

## Audit Procedure

Run the following commands and verify the output is as indicated:

```bash
# modprobe -n -v udf
install /bin/true
# lsmod | grep udf
<No output>
```

## Expected Result

- `modprobe -n -v udf` should return `install /bin/true`
- `lsmod | grep udf` should return no output

## Remediation

Edit or create a file in the `/etc/modprobe.d/` directory ending in `.conf`.
Example: `vim /etc/modprobe.d/udf.conf`
and add the following line:

```
install udf /bin/true
```

Run the following command to unload the `udf` module:

```bash
# rmmod udf
```

## CIS Controls

| Controls Version | Control                                                                                                                                                                                                                                                                                                                                                               | IG 1 | IG 2 | IG 3 |
| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software - Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.                                                                                                                   |      | x    | x    |
| v8               | 5.5 Establish and Maintain an Inventory of Service Accounts - Establish and maintain an inventory of service accounts. The inventory, at a minimum, must contain department owner, review date, and purpose. Perform service account reviews to validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently. |      | x    | x    |
| v7               | 3.3 Protect Dedicated Assessment Accounts - Use a dedicated account for authenticated vulnerability scans, which should not be used for any other administrative activities and should be tied to specific machines at specific IP addresses.                                                                                                                         |      | x    | x    |

## Profile

Level 2 - Server | Automated