Disable CAN Support
An XCCDF Rule
Description
The Controller Area Network (CAN) is a serial communications
protocol which was initially developed for automotive and
is now also used in marine, industrial, and medical applications.
To configure the system to prevent the can
kernel module from being loaded, add the following line to the file /etc/modprobe.d/can.conf:
install can /bin/true
Rationale
Disabling CAN protects the system against exploitation of any flaws in its implementation.
- ID
- xccdf_org.ssgproject.content_rule_kernel_module_can_disabled
- Severity
- Medium
- References
- Updated
Remediation - Kubernetes Patch
---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
config:
ignition: