Disable Mounting of udf
Ensures the udf kernel module is not loaded and is blacklisted so this rarely needed filesystem driver cannot be auto-loaded.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Removing support for unneeded filesystem types reduces the local attack surface of the system. The udf driver (Universal Disk Format, used by DVDs and some removable media) parses attacker-supplied media; a flaw in it is a local privilege-escalation or denial-of-service vector. Unless the host mounts optical/UDF media, the module should be neither loaded nor loadable.
What Pavois checks
Pavois queries the effective module state, not config files: it checks udf is absent from the running kernel and that modprobe refuses to load it. Reading /etc/modprobe.d/*.conf alone would miss a module already loaded (e.g. after a DVD was inserted) or pulled in by an unexpected drop-in; querying the live kernel catches both.
describe kernel_module('udf') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
lsmod | grep udfshould return nothing.modprobe -n -v udfshould printinstall /bin/true.grep -r udf /etc/modprobe.d/should showblacklist udfandinstall udf /bin/true.
Inspect & investigate
dmesg | grep -i udfandjournalctl -k | grep udfshow kernel/module load events.lsmodandmodprobe -n -v udfreflect the live state.
Remediation
Pavois's harden plan uses the kernel_module resource to blacklist udf: it writes a modprobe drop-in blacklisting the module and redirecting its load to /bin/true, then unloads it if active. A reboot is required to fully clear an in-use module. Apply with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | udf |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low risk on servers. Caution: blacklisting udf prevents mounting DVDs and some UDF-formatted USB media; some installer/ISO workflows and Windows-interop drives use UDF. If the host needs to mount optical or UDF media, verify with findmnt -t udf before applying and exclude the rule there.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.1.1.8, 1.1.1.7 | direct | per OS, see the benchmark table | high |
| NIST | 3.4.6, CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.