Block rarely used file systems
Mounting a crafted disk or stick can exploit the code of an old file system. This keeps the kernel from loading the ones almost nobody uses.
Why it matters
A USB stick or disk image can be built to trigger a bug in the code that reads its file system. The kernel contains many drivers for old or specialized formats, and the less-used ones get little review. If the driver cannot load, a crafted disk cannot reach it.
How it works
Adds a modprobe configuration that blocks loading the modules in the rare-filesystems group. Mounting such a disk then fails because the kernel cannot load the file system driver.
Who should use it
Good for people who only use common formats such as ext4, btrfs, xfs, FAT, exFAT and NTFS. Leave it off if you read DVDs or UDF images, old Mac disks, or embedded images.
What you may notice
Mounting a blocked format fails with an error such as unknown filesystem type. Optical discs and UDF images are the most likely to surface this.
Check it on your computer
See whether the modules are loaded:
lsmod | grep -E '^(cramfs|freevxfs|jffs2|hfs|hfsplus|udf) 'Apply it by hand
Tell the system not to load them, in a file you own:
sudo tee /etc/modprobe.d/90-modules-rare-filesystems.conf <<'EOF'
install cramfs /bin/false
install freevxfs /bin/false
install jffs2 /bin/false
install hfs /bin/false
install hfsplus /bin/false
install udf /bin/false
EOFUndo it
Remove the file. Modules already loaded stay until the next restart.
Related settings
Sources
- Linux Hardening Guide (madaidans)
- 2.5.2