securing oracle linux 9 part 1 disabling unnecessary filesystem modules

سیستم عامل و زیرساخت بازدید: 3

In this series, I have tried to present the process of securing Oracle Linux 9.7 based on CIS Benchmark standards in a practical and applicable manner for Oracle Database Administrators. This series consists of 29 articles, each examining a specific security control and providing two main sections:

  • An Audit script using Bash to verify the system status
  • A Remediation script to apply the fix if required

To make using these scripts easier, I have published a central module on GitHub that can invoke all the scripts. By using it, you can:

  • Run each script individually
  • Or execute all controls at once

Since some DBAs might not be familiar with Bash, a basic Bash tutorial tailored for Oracle DBAs is also included in this series to make understanding and using the scripts simpler.

All of these scripts have been tested on a clean Oracle Linux 9.7 installation. On this environment, Oracle ASM was installed first, and then Oracle Database was deployed to analyze the behavior of the scripts under conditions close to a real production database environment.

Given that this project is published as Open Source, it is highly recommended to carefully study the content of each section and the scripts before using them, and execute them only after ensuring compatibility with your environment. Using these scripts is at the user's own risk, and it is best to test them in staging/test environments first.

CIS Benchmark Requirements (Section 1.1.1)

This article covers and implements the following sections of the CIS standard (Oracle Linux 9 version):

  • 1.1.1 Configure Filesystem Kernel Modules
  • 1.1.1.1 Ensure cramfs kernel module is not available (Automated)
  • 1.1.1.2 Ensure freevxfs kernel module is not available (Automated)
  • 1.1.1.3 Ensure hfs kernel module is not available (Automated)
  • 1.1.1.4 Ensure hfsplus kernel module is not available (Automated)
  • 1.1.1.5 Ensure jffs2 kernel module is not available (Automated)
  • 1.1.1.6 Ensure squashfs kernel module is not available (Automated)
  • 1.1.1.7 Ensure udf kernel module is not available (Automated)
  • 1.1.1.8 Ensure usb-storage kernel module is not available (Automated)
  • 1.1.1.9 Ensure unused filesystems kernel modules are not available (Manual)

1. Concept & Rationale

What does the CIS standard require?

By default, the Linux operating system includes drivers (kernel modules) to support dozens of different filesystem types. CIS mandates that modules related to legacy, non-functional filesystems on servers, and removable storage media (such as USB and DVD) must be completely disabled (blacklisted).

Risk of Ignoring:

Less frequently used filesystem modules (such as cramfs or hfsplus) are typically not as thoroughly tested or security-audited as primary filesystems (like ext4 or xfs). Consequently, history has shown that these modules contain numerous kernel-level vulnerabilities.

An attacker could trigger a Buffer Overflow or execute malicious code at the kernel level (Privilege Escalation) by connecting a malicious USB drive physically to the server, or remotely by uploading and mounting a crafted image file.

How the system becomes more secure:

By disabling these modules, we implement the principle of Attack Surface Reduction. Even if a user or an application attempts to call these filesystems, the operating system runs the `/bin/true` command (a dummy, successful operation) instead of loading the vulnerable module, thereby blocking the attack path.

 

2. Compatibility with Oracle Database and Oracle RAC

In enterprise environments, kernel-level changes must be performed with high caution.

  • Single Instance Database: Oracle Database only requires standard Linux filesystems (XFS or ext4) and/or Oracle ASM (Automatic Storage Management) to store its files. There is absolutely no need for macOS filesystems (hfs), DVDs (udf), or USB/flash drives (usb-storage and jffs2).
  • Oracle RAC & Grid Infrastructure: In the most complex scenario, Oracle RAC, node interconnectivity and shared storage are provided via private networks (Private Interconnect) and RAW or ASM disks. Furthermore, if Oracle ACFS (Oracle Cluster File System) is used, Oracle's own dedicated modules are loaded. Disabling compressed filesystems (squashfs, cramfs) will not impact Clusterware mechanisms, Voting Disks, or OCR in any way.

Compatibility Verdict:

Fully secure with no conflicts. Implementing this section on Oracle Database servers (even in RAC environments) is 100% safe and will not interfere with the infrastructure's operation.

3. How to Audit the Current Status (Audit Script)

This script is designed modularly so it can also be used as part of a larger monitoring system. The script checks whether the module is blacklisted in the configuration files and verifies if it is currently loaded in the kernel.

Link to this script on GitHub:

modules/audit_01_Disable_Unused_Filesystems.sh

If you are not familiar with Bash scripting, you can refer to the tutorial I have published on the website for DBAs.

Bash for Oracle DBAs

#!/bin/bash
# Script: audit_cis_1_1_1.sh
# Purpose: Audit Filesystem Kernel Modules (CIS 1.1.1)

MODULES=("cramfs" "freevxfs" "hfs" "hfsplus" "jffs2" "squashfs" "udf" "usb-storage")
FAIL_COUNT=0

# --- Audit Description Header ---
echo -e "\n=========================================================================="
echo -e "[+] AUDIT: CIS 1.1.1 - Filesystem Kernel Modules"
echo -e "--------------------------------------------------------------------------"
echo -e "CIS Requirement : Disable loading of unnecessary filesystem kernel modules"
echo -e " (cramfs, freevxfs, hfs, hfsplus, jffs2, squashfs, udf)"
echo -e " to reduce the attack surface."
echo -e "Oracle Context : Fully compatible. No exceptions required for Oracle DB/RAC."
echo -e "==========================================================================\n"

for mod in "${MODULES[@]}"; do
# Check if module loading is disabled
LOAD_CHECK=$(modprobe -n -v "$mod" 2>/dev/null | grep -E "(install /bin/true|install /bin/false)")
# Check if module is currently loaded in memory
MEM_CHECK=$(lsmod | grep "^$mod ")

if [[ -n "$LOAD_CHECK" ]] && [[ -z "$MEM_CHECK" ]]; then
echo -e " [PASS] Module '$mod' is securely disabled and not loaded."
else
echo -e " [FAIL] Module '$mod' is NOT properly disabled or is currently loaded."
FAIL_COUNT=$((FAIL_COUNT + 1))
fi
done

echo -e "--------------------------------------------------------------------------"
if [ "$FAIL_COUNT" -eq 0 ]; then
echo -e "[+] AUDIT RESULT: PASSED (All unnecessary filesystem modules are disabled.)\n"
exit 0
else
echo -e "[-] AUDIT RESULT: FAILED ($FAIL_COUNT module(s) require remediation.)\n"
exit 1
fi

4. How to Apply Settings (Remediation Bash Script)

This script is written so that it can be run individually or sourced within your main main.sh script (to apply the overall CIS configurations).

Link to this script on GitHub:

modules/remediate_01_Disable_Unused_Filesystems.sh

#!/bin/bash
# Script: remediate_cis_1_1_1.sh
# Purpose: Remediate Filesystem Kernel Modules (CIS 1.1.1)

# Ensure script is run as root
if [ "$EUID" -ne 0 ]; then
echo "Please run as root"
exit 1
fi

MODULES=("cramfs" "freevxfs" "hfs" "hfsplus" "jffs2" "squashfs" "udf" "usb-storage")
CONF_DIR="/etc/modprobe.d"

echo -e "\n[+] Applying Remediation for CIS 1.1.1: Filesystem Kernel Modules..."

for mod in "${MODULES[@]}"; do
CONF_FILE="$CONF_DIR/cis_1_1_1_${mod}.conf"

# Create configuration file to disable module
echo "install $mod /bin/true" > "$CONF_FILE"
echo "blacklist $mod" >> "$CONF_FILE"
chmod 644 "$CONF_FILE"

# Unload the module if it is currently loaded in the kernel
if lsmod | grep -q "^$mod "; then
rmmod "$mod" 2>/dev/null || modprobe -r "$mod" 2>/dev/null
echo " [*] Unloaded active module: $mod"
fi

echo " [+] Disabled and blacklisted: $mod"
done

echo -e "[+] Remediation applied successfully. (Run audit script to verify)\n"

 

In the next part, we will discuss

Configuring Partions and Mount Options

...