control os-10 fails (/etc/modprobe.d/dev-sec.conf)

[jonasduarte]

Guys,

From where does /etc/modprobe.d/dev-sec.conf come from? The control os-10 fails on all my linux nodes (Ubuntu 16.04, CentOS 7.3 and Amazon Linux), I just can't find any reference for it

control 'os-10' do
impact 1.0
title 'CIS: Disable unused filesystems'
desc '1.1.1 Ensure mounting of cramfs, freevxfs, jffs2, hfs, hfsplus, squashfs, udf, FAT'
describe file('/etc/modprobe.d/dev-sec.conf') do
its(:content) { should match 'install cramfs /bin/true' }
its(:content) { should match 'install freevxfs /bin/true' }
its(:content) { should match 'install jffs2 /bin/true' }
its(:content) { should match 'install hfs /bin/true' }
its(:content) { should match 'install hfsplus /bin/true' }
its(:content) { should match 'install squashfs /bin/true' }
its(:content) { should match 'install udf /bin/true' }
its(:content) { should match 'install vfat /bin/true' }
end
end

Best,

[atomic111]

@jonasduarte yes we have to implement this in the chef, ansible and puppet modules

#71

if you want to skip this control in InSpec. you can use InSpec inheritance

https://blog.chef.io/2017/07/06/understanding-inspec-profile-inheritance/

[chris-rock]

@atomic111 as an improvement we probably want to parse all modprobe configs and not rely on dev-sec config only?

[atomic111]

@chris-rock oh yes this is a far more better idea!!!! thanks for your input

[chris-rock]

We still need to fix this in chef cookbook :-)

[artem-sidorenko]

Its mainly my fault, I did not have time to implement that directly after the merge in linux-baseline. I'll try to do that this week

[atomic111]

it is solved by PR dev-sec/chef-os-hardening#169

Thank you @artem-sidorenko

[artem-sidorenko]

@jonasduarte chef implementation is in dev-sec/chef-os-hardening#169, puppet implementation is in dev-sec/puppet-os-hardening#100.

Even if both changes are not released yet, I assume they address this issue. So I'll close it , feel free to reopen if necessary

[joshuatalb]

This should not be closed as this change hasn't been applied to the Ansible playbooks. I'll try and get time this week to merge it.

[rndmh3ro]

What do you mean, @joshuatalb? It's implemented here: https://github.com/dev-sec/ansible-os-hardening/blob/master/tasks/modprobe.yml

[joshuatalb]

@rndmh3ro apologies - hadn't had my coffee before I wrote this. You are correct!