Disable Mounting of jffs2
Ensures the jffs2 flash filesystem kernel module cannot be loaded, so the embedded-flash driver is unavailable.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
jffs2 is a log-structured filesystem for raw flash (NOR/NAND) memory, used on embedded devices and almost never on servers. Every loadable filesystem driver adds attack surface: parsing untrusted flash images has historically caused kernel memory-corruption bugs. An attacker who can present a crafted image could exploit flaws in this rarely-used driver to crash the kernel or run code. Disabling it removes that exposure on systems that have no JFFS2 storage.
What Pavois checks
Pavois uses the InSpec kernel_module('jffs2') resource to confirm the module is not loaded and is disabled (blacklist plus an install ... /bin/true override). This reflects the effective kernel state via lsmod and modprobe --showconfig, not a static grep of /etc/modprobe.d/. A drop-in that re-enables loading is caught even when a config file appears correct.
describe kernel_module('jffs2') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
Run modprobe -n -v jffs2, it should print install /bin/true. Confirm it is not loaded with lsmod | grep jffs2 (no output expected). modprobe --showconfig | grep jffs2 should show a blacklist jffs2 and an install jffs2 /bin/true line.
Inspect & investigate
Load attempts appear in the kernel ring buffer: dmesg | grep jffs2 or journalctl -k | grep jffs2. The effective modprobe policy is shown by modprobe --showconfig | grep jffs2.
Remediation
pavois harden apply uses the kernel_module resource to blacklist jffs2: it writes a drop-in under /etc/modprobe.d/ with blacklist jffs2 and install jffs2 /bin/true, and unloads the module if loaded. Because the driver may be resident in the running kernel or initramfs, reboot_required is true to guarantee it is not active.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | jffs2 |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if not applied: a loadable flash-filesystem driver remains exploitable via a crafted image.
- Before applying, confirm the host has no raw-flash (NOR/NAND) storage using JFFS2, essentially never the case on standard servers and VMs.
- Non-disruptive on typical deployments; only embedded/appliance systems relying on JFFS2 are affected.
- A reboot is required for full effect, schedule it in a maintenance window.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.1.1.5 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.6, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.