Ensure That Unnecessary FileSystems Are Disabled

Linux supports multiple filesystems, which are loaded into the kernel as kernel modules (ko). As a versatile OS platform, openEuler provides various filesystems in ko format under the /lib/modules/<kernel version>/kernel/fs/ directory, and these filesystems can be loaded using the insmod or modprobe command.

Disabling unnecessary filesystems helps reduce the attack surface, preventing attackers from exploiting vulnerabilities in uncommon filesystems to compromise the system. Users can evaluate which filesystems are not required based on actual production scenarios and configure the system to block their mounting. Commonly disabled filesystems are as follows:

cramfs, freevxfs, jffs2, hfs, hfsplus, squashfs, udf, vfat, fat, msdos, nfs, ceph, fuse, overlay, and xfs.

1. Run the following command to check the status of a specific filesystem (using cramfs as an example).

   modprobe -n -v cramfs | grep -E '(cramfs|install)' 

   install /bin/true

   • If the command output contains install /bin/true, the filesystem cannot be mounted.
   • If the command output contains insmod /lib/modules/<kernel version>/kernel/fs/cramfs/cramfs.ko, the filesystem can still be mounted, and the path to its .ko module is displayed.
   • If any command output is displayed, the filesystem has been mounted. If no command output is displayed, run the following command.

     lsmod | grep cramfs 

     cramfs  135168  0

2. If a filesystem has been mounted but is not required in actual scenarios, run the following command to remove it. The following uses cramfs as an example. The procedure for other filesystems is similar.

   modprobe -r cramfs

3. Create a configuration file ending in .conf (e.g., test.conf) under the /etc/modprobe.d/ directory. Set the owner and owner group to root with permissions set to 600:
   1. Create a configuration file. The file name can be customized (e.g., test.conf).

      vim /etc/modprobe.d/test.conf

   2. Press i to enter the insert mode. Append the filesystems to be disabled to the file in the following format based on your requirements:

      install cramfs /bin/true 
      install freevxfs /bin/true 
      install jffs2 /bin/true 
      install hfs /bin/true 
      install hfsplus /bin/true 
      install squashfs /bin/true 
      install udf /bin/true 
      install vfat /bin/true 
      install fat /bin/true 
      install msdos /bin/true 
      install nfs /bin/true 
      install ceph /bin/true 
      install fuse /bin/true 
      install overlay /bin/true 
      install xfs /bin/true

   3. Press Esc to exit the insert mode. Type :wq! and press Enter to save the file and exit.