lowkernelverified ✓rollback-safe
Disable hfs kernel module
kmod-disable-hfs · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
The hfs filesystem type is the legacy Apple Mac OS filesystem, rarely needed on Linux and an unnecessary kernel attack surface.
Rationale
Removing support for unneeded filesystem types reduces the local attack surface. If this filesystem type is not needed, it should not be loadable.
Check → Remediate
Checkkernel_module_state
- name:
- hfs
- state:
- blacklisted
Remediatekernel_module_disable
- name:
- hfs
Framework references
CIS
rhel8 1.1.1.3rhel9 1.1.1.3rhel10 1.1.1.3ubuntu22 1.1.1.3ubuntu24 1.1.1.3
NIST 800-53
CM-7
Live verification
rhel10:checkrhel8:checkrhel9:checkubuntu22:checkubuntu24:check
#kernel-module#attack-surface#cis