Improve CIS UDF kernel module check

[stmcginnis]

Issue number:

N/A

Description of changes:

The level 2 check 1.1.1.1 verifies mounting UDF filesystems is disabled. The current check for whether it is already loaded was not correct. Luckily there is a second check as part of this control to make sure loading is disabled. If the setting for loading is to not allow it, but the module is already loaded, the check does not return the expected output. So it would still report failure, but it is less than ideal for reporting the actual issue.

This changes the check for whether the module is loaded to correctly identify if the module is loaded or not before checking whether the ability has been disabled.

Testing done:

Ran the level 2 report on a default deployment and verified it reported FAIL for this check.

Checked the loaded but disabled scenario:

bash-5.1# lsmod | grep udf

bash-5.1# modprobe -v -n udf
insmod /lib/modules/5.15.134/kernel/drivers/cdrom/cdrom.ko.xz 
insmod /lib/modules/5.15.134/kernel/lib/crc-itu-t.ko.xz 
insmod /lib/modules/5.15.134/kernel/fs/udf/udf.ko.xz

bash-5.1# insmod /lib/modules/5.15.134/kernel/drivers/cdrom/cdrom.ko.xz

bash-5.1# insmod /lib/modules/5.15.134/kernel/lib/crc-itu-t.ko.xz

bash-5.1# insmod /lib/modules/5.15.134/kernel/fs/udf/udf.ko.xz

bash-5.1# grep udf /proc/modules 
udf 139264 0 - Live 0xffffffffc0636000
crc_itu_t 16384 1 udf, Live 0xffffffffc0631000
cdrom 77824 1 udf, Live 0xffffffffc061d000

bash-5.1# apiclient set kernel.modules.udf.allowed=false

bash-5.1# modprobe -v -n udf                             

bash-5.1# apiclient report cis -l 2
...
[FAIL] 1.1.1.1   Ensure mounting of udf filesystems is disabled (Automatic)
...

Then unloaded the module and made sure it correctly identifies the module is not loaded and loading is disabled:

bash-5.1# rmmod udf

bash-5.1# modprobe -v -n udf                             
install /bin/true 

bash-5.1# apiclient report cis -l 2
...
[PASS] 1.1.1.1   Ensure mounting of udf filesystems is disabled (Automatic)
...

Then unload

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[bcressey]

Nice!

[yeazelm]

LGTM!