Disable Mounting of hfsplus
Ensures the hfsplus filesystem kernel module cannot be loaded, so the Apple HFS+ driver is unavailable.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The hfsplus filesystem is Apple's HFS+ (Mac OS Extended), needed only to read Mac-formatted media. Every loadable filesystem driver adds attack surface: parsing untrusted disk structures has repeatedly produced memory-corruption vulnerabilities. An attacker who can attach a USB drive or have a malicious image mounted could exploit flaws in this rarely-needed driver to crash the kernel or execute code. Disabling it removes that exposure on hosts that never read HFS+ media.
What Pavois checks
Pavois uses the InSpec kernel_module('hfsplus') resource to confirm the module is not loaded and is disabled (blacklist plus an install ... /bin/true override). This reflects the effective kernel state via lsmod and modprobe --showconfig, not a static read of /etc/modprobe.d/. A drop-in that re-enables loading is caught even when a config file looks fine.
describe kernel_module('hfsplus') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
Run modprobe -n -v hfsplus, it should print install /bin/true. Confirm it is not loaded with lsmod | grep hfsplus (no output expected). modprobe --showconfig | grep hfsplus should show a blacklist hfsplus and an install hfsplus /bin/true line.
Inspect & investigate
Load attempts surface in the kernel ring buffer: dmesg | grep hfsplus or journalctl -k | grep hfsplus. The effective modprobe policy is shown by modprobe --showconfig | grep hfsplus.
Remediation
pavois harden apply uses the kernel_module resource to blacklist hfsplus: it writes a drop-in under /etc/modprobe.d/ with blacklist hfsplus and install hfsplus /bin/true, and unloads the module if loaded. Because the driver may be resident in the running kernel or initramfs, reboot_required is true to guarantee it is not active.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | hfsplus |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if not applied: a loadable legacy filesystem driver remains exploitable via mounting Apple HFS+ media or a crafted image.
- Before applying, confirm the host does not need to read HFS+-formatted Apple media (very rare on servers).
- Non-disruptive on standard deployments; only affects workflows mounting HFS+ volumes.
- A reboot is required for full effect, schedule it in a maintenance window.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.1.1.4 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.6, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.