search

ovh / debian-cis

PCI-DSS compliant Debian 10/11/12 hardening
Other
757 stars 130 forks source link

Fix 3.4.2 audit rule #123

Closed sblaisot closed 2 years ago

sblaisot commented 3 years ago

3.4.2 CIS detection example is modprobe -n -v sctp | grep -E '(sctp|install)'

MODPROBE_FILTER is necessary here because sctp module depends on libcrc32c module so even if it is disabled, modprobe -n -v sctp returns

insmod /lib/modules/4.19.0-18-cloud-amd64/kernel/lib/libcrc32c.ko 
install /bin/true

and detection fails

This PR fixes that behaviour by adding missing MODPROBE_FILTER to is_kernel_option_enabled call.