Disable Mounting of freevxfs
Ensures the freevxfs filesystem kernel module cannot be loaded, so the legacy Veritas VxFS driver is unavailable.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The freevxfs filesystem (Veritas VxFS) is rarely needed on modern Linux systems. Every filesystem driver the kernel can load is additional, often poorly-audited, code reachable from removable media or crafted disk images. An attacker who can attach a USB device or get a malicious image mounted can trigger parsing bugs in this legacy driver to crash the kernel or gain code execution. Removing support for filesystems the host does not use shrinks the kernel attack surface.
What Pavois checks
Pavois uses the InSpec kernel_module('freevxfs') resource to confirm the module is not loaded and is disabled (blacklisted plus an install ... /bin/true override). This reflects the effective kernel state via lsmod and modprobe --showconfig, not just a grep of /etc/modprobe.d/. A drop-in or initramfs that re-enables the module would be caught here even if a config file looks correct.
describe kernel_module('freevxfs') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
Run modprobe -n -v freevxfs, it should print install /bin/true (load is redirected to a no-op). Confirm it is not currently loaded with lsmod | grep freevxfs (no output expected). modprobe --showconfig | grep freevxfs should show both a blacklist freevxfs and an install freevxfs /bin/true line.
Inspect & investigate
Attempts to load the module leave traces in the kernel ring buffer: dmesg | grep freevxfs or journalctl -k | grep freevxfs. The active configuration is shown by modprobe --showconfig | grep freevxfs.
Remediation
pavois harden apply uses the kernel_module resource to blacklist freevxfs: it writes a drop-in under /etc/modprobe.d/ containing blacklist freevxfs and install freevxfs /bin/true, and unloads the module if it is currently loaded. Because the driver may be compiled into the running kernel or initramfs, reboot_required is true, a reboot guarantees the module is not active.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | freevxfs |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if not applied: the host keeps a loadable legacy filesystem driver that can be triggered by mounting removable media or a crafted image, expanding the kernel attack surface.
- Before applying, confirm no current or planned workload reads
freevxfsvolumes (Veritas VxFS is essentially absent from standard Linux deployments). - The change is non-disruptive on virtually all servers; impact is limited to systems that genuinely mount VxFS storage.
- A reboot is needed for full effect; schedule it during a maintenance window.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.1.1.2 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.6, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.