Skip to content
Log In

Disable CAN Support

An XCCDF Rule

Description

The Controller Area Network (CAN) is a serial communications protocol which was initially developed for automotive and is now also used in marine, industrial, and medical applications. To configure the system to prevent the can kernel module from being loaded, add the following line to the file /etc/modprobe.d/can.conf: 
install can /bin/false

Rationale

Disabling CAN protects the system against exploitation of any flaws in its implementation.

ID
xccdf_org.ssgproject.content_rule_kernel_module_can_disabled
Severity
Medium
References
Updated

Remediation Templates

A Kubernetes Patch

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0