Disable Mounting of hfs
Ensures the hfs filesystem kernel module cannot be loaded, so the legacy Apple HFS driver is unavailable.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The hfs filesystem is Apple's legacy Hierarchical File System, needed only to read old Mac media. Every filesystem driver the kernel can load adds attack surface: parsing untrusted disk structures has historically caused memory-corruption bugs. An attacker who can attach a USB drive or get a malicious image mounted could exploit flaws in this rarely-used driver to crash the system or run code in the kernel. Disabling it removes that exposure on systems that never touch HFS media.
What Pavois checks
Pavois uses the InSpec kernel_module('hfs') resource to confirm the module is not loaded and is disabled (blacklist plus an install ... /bin/true override). This reflects the effective kernel state via lsmod and modprobe --showconfig, not just a static grep of /etc/modprobe.d/. A drop-in that re-enables loading would be detected here even if a config file appears correct.
describe kernel_module('hfs') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
Run modprobe -n -v hfs, it should print install /bin/true. Confirm it is not loaded with lsmod | grep hfs (no output expected). modprobe --showconfig | grep hfs should list a blacklist hfs and an install hfs /bin/true line.
Inspect & investigate
Load attempts appear in the kernel ring buffer: dmesg | grep hfs or journalctl -k | grep hfs. The active modprobe policy is shown by modprobe --showconfig | grep hfs.
Remediation
pavois harden apply uses the kernel_module resource to blacklist hfs: it writes a drop-in under /etc/modprobe.d/ with blacklist hfs and install hfs /bin/true, and unloads the module if loaded. Because the driver may already be resident in the running kernel or initramfs, reboot_required is true to guarantee it is not active.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | hfs |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if not applied: a loadable legacy filesystem driver remains exploitable via mounting Apple media or a crafted image.
- Before applying, confirm the host does not need to read HFS-formatted Apple media (very rare on servers).
- Non-disruptive on standard Linux deployments; only affects workflows that mount HFS volumes.
- A reboot is required for full effect, schedule it in a maintenance window.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.1.1.3 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.6, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.