lowkernelverified ✓rollback-safe
Disable overlay kernel module
kmod-disable-overlay · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
The overlay (OverlayFS) filesystem provides a union mount. Where not required (hosts not running containers), it should not be available.
Rationale
Removing support for unneeded filesystem types reduces the local attack surface. Note: OverlayFS is used by container runtimes and snap; only disable it where containers are not in use.
Check → Remediate
Checkkernel_module_state
- name:
- overlay
- state:
- blacklisted
Remediatekernel_module_disable
- name:
- overlay
Framework references
CIS
rhel8 1.1.1.6rhel10 1.1.1.6ubuntu22 1.1.1.6ubuntu24 1.1.1.6
NIST 800-53
CM-7
Live verification
rhel9:checkubuntu22:checkubuntu24:check
#kernel-module#attack-surface#cis