Skip to content

fix: replace undefined LOADED_MODULE_NAME with MODULE_NAME in apply() functions#323

Open
george-petrakis wants to merge 2 commits into
ovh:masterfrom
george-petrakis:fix/unbound-loaded-module-name-in-apply
Open

fix: replace undefined LOADED_MODULE_NAME with MODULE_NAME in apply() functions#323
george-petrakis wants to merge 2 commits into
ovh:masterfrom
george-petrakis:fix/unbound-loaded-module-name-in-apply

Conversation

@george-petrakis

Copy link
Copy Markdown

Several kernel module hardening scripts used $LOADED_MODULE_NAME inside their apply() functions without ever defining it at the script level. With set -u active, this caused an immediate unbound variable crash (exit 1) any time a script ran in enabled mode.

The variable LOADED_MODULE_NAME is intentionally defined in disable_usb_storage.sh because the modprobe name (usb-storage) differs from the name as it appears in /proc/modules (usb_storage). The affected scripts have no such distinction — their module names are identical in both contexts — so the correct variable is MODULE_NAME, which is what audit() already used consistently in all of these files.

Affected scripts

11 in bin/hardening/, 2 in versions/default/:

  • disable_cramfs, disable_dccp, disable_freevxfs, disable_hfs, disable_hfsplus
  • disable_jffs2, disable_rds, disable_sctp, disable_squashfs, disable_tipc, disable_udf
  • versions/default/1.1.1.5_disable_squashfs.sh, versions/default/1.1.1.6_disable_udf.sh

Root cause

Copy-paste from disable_usb_storage.sh without carrying over the LOADED_MODULE_NAME definition.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants