Skip to content
Log In

Disable CAN Support

An XCCDF Rule

Description

The Controller Area Network (CAN) is a serial communications protocol which was initially developed for automotive and is now also used in marine, industrial, and medical applications. To configure the system to prevent the can kernel module from being loaded, add the following line to the file /etc/modprobe.d/can.conf: 
install can /bin/false
To configure the system to prevent the can from being used, add the following line to file /etc/modprobe.d/can.conf: 
blacklist can

Rationale

Disabling CAN protects the system against exploitation of any flaws in its implementation.

ID
xccdf_org.ssgproject.content_rule_kernel_module_can_disabled
Severity
Medium
References
Updated

Remediation Templates

A Kubernetes Patch

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0

A Shell Script

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
if LC_ALL=C grep -q -m 1 "^install can" /etc/modprobe.d/can.conf ; then
	
	sed -i 's#^install can.*#install can /bin/false#g' /etc/modprobe.d/can.conf
else

An Ansible Snippet

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-RHEL-08-040022
  - NIST-800-53-AC-18