Disable IEEE 1394 (FireWire) Support
An XCCDF Rule
Description
The IEEE 1394 (FireWire) is a serial bus standard for
high-speed real-time communication.
To configure the system to prevent the firewire-core
kernel module from being loaded, add the following line to the file /etc/modprobe.d/firewire-core.conf:
install firewire-core /bin/true
Rationale
Disabling FireWire protects the system against exploitation of any flaws in its implementation.
- ID
- xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled
- Severity
- Low
- References
- Updated
Remediation - Kubernetes Patch
---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
config:
ignition:
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
if LC_ALL=C grep -q -m 1 "^install firewire-core" /etc/modprobe.d/firewire-core.conf ; then
sed -i 's#^install firewire-core.*#install firewire-core /bin/true#g' /etc/modprobe.d/firewire-core.conf
Remediation - Ansible
- name: Ensure kernel module 'firewire-core' is disabled
lineinfile:
create: true
dest: /etc/modprobe.d/firewire-core.conf
regexp: install\s+firewire-core
line: install firewire-core /bin/false