cyberstrikeus 1.1.1.4 Ensure mounting of hfs filesystems is disabled (Scored)
Profile Applicability
- Level 1 - Server
- Level 1 - Workstation
Description
The hfs filesystem type is a hierarchical filesystem that allows you to mount Mac OS filesystems.
Rationale
Removing support for unneeded filesystem types reduces the local attack surface of the system. If this filesystem type is not needed, disable it.
Audit Procedure
modprobe -n -v hfs
# Expected output: install /bin/true
lsmod | grep hfs
# Expected output: <No output>
Expected Result
modprobe -n -v hfs should return install /bin/true and lsmod | grep hfs should return no output.
Remediation
# Edit or create the file /etc/modprobe.d/CIS.conf and add the following line:
echo "install hfs /bin/true" >> /etc/modprobe.d/CIS.conf
# Unload the hfs module:
rmmod hfs
Default Value
By default, hfs filesystem mounting is allowed.
References
- CIS Ubuntu Linux 14.04 LTS Benchmark v2.1.0
- CIS Controls: 13 Data Protection
Profile
- Level 1