Profile Applicability:
 • Level 2

Description:
 The squashfs kernel module provides support for the SquashFS compressed read-only filesystem. SquashFS is often used in embedded systems, live CDs, and other environments requiring compressed read-only filesystems.

Rationale:
 Disabling the squashfs kernel module when not needed reduces the kernel attack surface by removing unnecessary filesystem support and potential vulnerabilities related to this module.

Impact:
 Pros:

  • Reduces kernel attack surface by disabling unused filesystem modules.

  • Helps mitigate exploitation risks associated with the squashfs filesystem.

Cons:

  • Systems requiring SquashFS support will be unable to mount squashfs filesystems if the module is disabled.

Default Value:
 The squashfs kernel module may be available and enabled by default on many Linux distributions.

Pre-requisites:

  • Root or sudo privileges to modify kernel module configurations.

  • Access to /etc/modprobe.d/ for blacklisting or disabling the module.

Remediation:

Test Plan:

Using Linux command line:

  1. Check if the squashfs module is loaded:

    lsmod | grep squashfs

  2. Verify blacklist or disable entries:

     grep -r squashfs /etc/modprobe.d/

  3. Test module load behavior:

    modprobe -n -v squashfs

    Expected output should indicate the module is disabled, e.g., install /bin/false.


Implementation Plan:

Using Linux command line:

  1. Create or edit /etc/modprobe.d/squashfs.conf:

     echo "install squashfs /bin/false" > /etc/modprobe.d/squashfs.conf
 echo "blacklist squashfs" >> /etc/modprobe.d/squashfs.conf

  2. Unload the module if currently loaded:

     modprobe -r squashfs

  3. Reboot the system or reload module configurations.

Backout Plan:

Using Linux command line:

  1. Remove blacklist and disable entries:

    sed -i '/squashfs/d' /etc/modprobe.d/squashfs.conf

  2. Optionally reload the module:

     modprobe squashfs

  3. Reboot the system.

References: