← All rules
SOCLE-CLD-MOD-019// Kernel modulesloweffective runtime

Disable Mounting of squashfs

Ensures the squashfs kernel module is not loaded and is blacklisted so it cannot be auto-loaded on demand.

Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 2 standards

Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

Removing support for unneeded filesystem types reduces the local attack surface of the system. The squashfs driver parses untrusted, attacker-supplied images; any bug in it becomes a local privilege-escalation or denial-of-service vector. Unless the host actually mounts SquashFS images (e.g. Snap packages, which rely on it), the module should be neither loaded nor loadable.

What Pavois checks

Pavois queries the effective module state, not config files: it checks that squashfs is absent from the running kernel and that modprobe is configured to refuse loading it (install squashfs /bin/true plus a blacklist entry). Reading /etc/modprobe.d/*.conf alone would miss a module already loaded at runtime or one pulled in by an unexpected drop-in; querying the live kernel catches both.

describe kernel_module('squashfs') do
  it { should_not be_loaded }
  it { should be_disabled }
end

How to verify it is applied

  • lsmod | grep squashfs should return nothing (module not loaded).
  • modprobe -n -v squashfs should print install /bin/true (loading is neutralized).
  • grep -r squashfs /etc/modprobe.d/ should show a blacklist squashfs and an install squashfs /bin/true line.

Inspect & investigate

  • dmesg | grep -i squashfs shows kernel messages if the module is ever loaded.
  • journalctl -k | grep squashfs for boot-time module activity.
  • lsmod and modprobe -n -v squashfs reflect the live state at any time.

Remediation

Pavois's harden plan uses the kernel_module resource to blacklist squashfs: it writes a modprobe drop-in that blacklists the module and redirects its load to /bin/true, then unloads it if currently active. Because the module may already be in use, a reboot is required to fully clear it. Apply with pavois harden apply.

Pavois applies this with its own harden engine, the plan below, not a shell script:

actionblacklist
namesquashfs
reboot_requiredtrue
resourcekernel_module
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Low risk on servers. Caution: Snap packages depend on squashfs, blacklisting it on a host that uses Snap (common on Ubuntu desktops/some images) will break Snap mounts. Verify with mount | grep squashfs and snap list before applying; if Snap is in use, exclude this rule for that host.

Standards mapping

StandardReferenceTypeVersionConfidence
CIS1.1.1.6, 1.1.1.7directper OS, see the benchmark tablehigh
NIST3.4.6, CM-6(a), CM-7(a), CM-7(b)supporting800-53 Rev 5 · 800-171 Rev 2 (pinned)medium

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references