← All rules
SOCLE-CLD-MOD-005// Kernel modulesloweffective runtime

Disable Mounting of cramfs

Ensures the cramfs filesystem kernel module is not loaded and is blacklisted so cramfs images cannot be mounted.

Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 2 standards

Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

cramfs is an obsolete compressed read-only filesystem that modern systems do not need. Its driver still parses on-disk structures, so a crafted cramfs image (e.g. inserted via USB and auto-mounted) could trigger a kernel parsing bug. Removing support for unneeded filesystem types reduces the local attack surface of the server.

What Pavois checks

Pavois uses kernel_module('cramfs') to assert the module is not loaded and is disabled in the effective modprobe policy. Inspecting the live kernel plus the resolved modprobe config (not one .conf) catches a module blacklisted somewhere but still loaded, or re-enabled by an override drop-in.

describe kernel_module('cramfs') do
  it { should_not be_loaded }
  it { should be_disabled }
end

How to verify it is applied

Run lsmod | grep cramfs (no output = not loaded) and modprobe -n -v cramfs (expect install /bin/true or /bin/false). modprobe --showconfig | grep cramfs shows the effective rules.

Inspect & investigate

A blocked mount/load attempt is logged by the kernel: journalctl -k | grep -i cramfs / dmesg | grep -i cramfs. lsmod shows resident modules; modprobe --showconfig shows the policy.

Remediation

pavois harden apply uses the kernel_module resource to blacklist cramfs: it writes a modprobe rule (install cramfs /bin/false plus a blacklist entry) so the filesystem cannot be auto-loaded on mount, and unloads it if resident. reboot_required is true to guarantee removal.

Pavois applies this with its own harden engine, the plan below, not a shell script:

actionblacklist
namecramfs
reboot_requiredtrue
resourcekernel_module
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Disabling cramfs has no impact on normal operation. Precaution: a small number of embedded images or some snap/initramfs tooling historically used cramfs, verify no mounted filesystem is of type cramfs (findmnt -t cramfs, cat /proc/filesystems | grep cramfs) before applying. A reboot is needed to unload an already-loaded module.

Standards mapping

StandardReferenceTypeVersionConfidence
CIS1.1.1.1directper OS, see the benchmark tablehigh
NIST3.4.6, CM-6(a), CM-7(a), CM-7(b)supporting800-53 Rev 5 · 800-171 Rev 2 (pinned)medium

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references