Feature: cisModprobe
Description
A sub-feature of cis that denies kernel modules per CIS benchmark requirements. Must be used with the cis feature.
What it does
Denies the following kernel modules: cramfs, dccp, freevxfs, jffs2, rds, sctp, squashfs, tipc, udf. Note: fat is not denied despite the CIS recommendation, as it is required for UEFI boot.
Files
Files present in this feature and their purpose. See the feature file reference for the semantics of each file type.
| File | Purpose |
|---|---|
file.include.markers.yaml (ref) | Maps files to test-coverage marker IDs. |
info.yaml (ref) | Declares type: element and included/excluded features. |
file.include/etc/modprobe.d/cramfs.conf (file.include) | Denylists the cramfs filesystem module per CIS benchmark. |
file.include/etc/modprobe.d/dccp.conf (file.include) | Denylists the dccp network protocol module per CIS benchmark. |
file.include/etc/modprobe.d/freevxfs.conf (file.include) | Denylists the freevxfs filesystem module per CIS benchmark. |
file.include/etc/modprobe.d/jffs2.conf (file.include) | Denylists the jffs2 filesystem module per CIS benchmark. |
file.include/etc/modprobe.d/rds.conf (file.include) | Denylists the rds network protocol module per CIS benchmark. |
file.include/etc/modprobe.d/sctp.conf (file.include) | Denylists the sctp network protocol module per CIS benchmark. |
file.include/etc/modprobe.d/squashfs.conf (file.include) | Denylists the squashfs filesystem module per CIS benchmark. |
file.include/etc/modprobe.d/tipc.conf (file.include) | Denylists the tipc network protocol module per CIS benchmark. |
file.include/etc/modprobe.d/udf.conf (file.include) | Denylists the udf filesystem module per CIS benchmark. |
Related features
This feature has no include or exclude relationships.