<Group id="mounting">
<title>Restrict Dynamic Mounting and Unmounting of
Filesystems</title>
<description>Linux includes a number of facilities for the automated addition
and removal of filesystems on a running system.  These facilities may be
necessary in many environments, but this capability also carries some risk -- whether direct
risk from allowing users to introduce arbitrary filesystems,
or risk that software flaws in the automated mount facility itself could
allow an attacker to compromise the system.
<br /><br />
This command can be used to list the types of filesystems that are
available to the currently executing kernel:
<pre># find /lib/modules/`uname -r`/kernel/fs -type f -name '*.ko'</pre>
If these filesystems are not required then they can be explicitly disabled
in a configuratio file in  <tt>/etc/modprobe.d</tt>.
</description>

<Rule id="kernel_module_usb-storage_disabled">
<title>Disable Modprobe Loading of USB Storage Driver</title>
<description>
To prevent USB storage devices from being used, configure the kernel module loading system
to prevent automatic loading of the USB storage driver. 
<module-disable-macro module="usb-storage" />
This will prevent the <tt>modprobe</tt> program from loading the <tt>usb-storage</tt>
module, but will not prevent an administrator (or another program) from using the
<tt>insmod</tt> program to load the module manually.</description>
<ocil>
<module-disable-check-macro module="usb-storage" />
</ocil>
<rationale>USB storage devices such as thumb drives can be used to introduce
malicious software.</rationale>
<ident stig="GEN008480" />
<oval id="kernel_module_usb-storage_disabled" />
<ref nist="ECSC-1" disa="366" />
</Rule>

<Rule id="bootloader_nousb_argument">
<title>Disable Kernel Support for USB via Bootloader Configuration</title>
<description>
All USB support can be disabled by adding the <tt>nousb</tt>
argument to the kernel's boot loader configuration. To do so, 
append "nousb" to the kernel line in <tt>/etc/grub.conf</tt> as shown:
<pre>kernel /vmlinuz-<i>VERSION</i> ro vga=ext root=/dev/VolGroup00/LogVol00 rhgb quiet nousb</pre>
<i><b>WARNING:</b> Disabling all kernel support for USB will cause problems for
systems with USB-based keyboards, mice, or printers. This configuration is
infeasible for systems which require USB devices, which is common.</i></description>
<rationale>Disabling the USB subsystem within the Linux kernel at system boot will
protect against potentially malicious USB devices, although it is only practical
in specialized systems.
</rationale>
<ident stig="GEN008460" />
<oval id="bootloader_nousb_argument" />
<ref nist="ECSC-1" disa="366" />
</Rule>

<Rule id="service_autofs_disabled">
<title>Disable the Automounter</title>
<description>The <tt>autofs</tt> daemon mounts and unmounts filesystems, such as user
home directories shared via NFS, on demand. In addition, autofs can be used to handle
removable media, and the default configuration provides the cdrom device as <tt>/misc/cd</tt>.
However, this method of providing access to removable media is not common, so autofs
can almost always be disabled if NFS is not in use. Even if NFS is required, it may be
possible to configure filesystem mounts statically by editing <tt>/etc/fstab</tt>
rather than relying on the automounter.
<br /><br />
<service-disable-macro service="autofs" />
</description>
<ocil>
<service-disable-check-macro service="autofs" />
</ocil>
<rationale>Disabling the automounter permits the administrator to 
statically control filesystem mounting through <tt>/etc/fstab</tt>. 
</rationale>
<ident stig="GEN008440" />
<oval id="service_autofs_disabled" />
<ref nist="ECSC-1" disa="366" />
</Rule>

</Group>
