is there a way w osquery to see if squashfs and cramfs are e

Question

is there a way w osquery to see if squashfs and cramfs are enabled on a host system

alessandrogario · Answer

Could Augeas + the config file under boot be helpful

alessandrogario · Answer

Or a Yara rule looking for the config option string

alessandrogario · Answer

If it is built as a module the file table can find it

Zach Zeid · Answer

if what is built as a module enabling file events

alessandrogario · Answer

I may have misunderstood the problem is squashfs support in the kernel If it is it s either built in or relying on a ko kernel module somewhere on disk

alessandrogario · Answer

Dumping the kernel build time config will contain the configuration string such as `CONFIG FEATURE NAME` and may indicate whether it s built in module or off completely

alessandrogario · Answer

On my system ```$ grep SQUASH boot config 5 18 13 200 fc36 x86 64 CONFIG SQUASHFS=m CONFIG SQUASHFS FILE CACHE is not set CONFIG SQUASHFS FILE DIRECT=y CONFIG SQUASHFS DECOMP SINGLE is not set CONFIG SQUASHFS DECOMP MULTI is not set CONFIG SQUASHFS DECOMP MULTI PERCPU=y CONFIG SQUASHFS XATTR=y CONFIG SQUASHFS ZLIB=y CONFIG SQUASHFS LZ4=y CONFIG SQUASHFS LZO=y CONFIG SQUASHFS XZ=y CONFIG SQUASHFS ZSTD=y CONFIG SQUASHFS 4K DEVBLK SIZE is not set CONFIG SQUASHFS EMBEDDED is not set CONFIG SQUASHFS FRAGMENT CACHE SIZE=3```

alessandrogario · Answer

```$ find lib modules type f iname squash ko lib modules 5 18 13 200 fc36 x86 64 kernel fs squashfs squashfs ko xz lib modules 5 18 16 200 fc36 x86 64 kernel fs squashfs squashfs ko xz lib modules 5 18 17 200 fc36 x86 64 kernel fs squashfs squashfs ko xz```

alessandrogario · Answer

In my case it s built as a module `CONFIG SQUASHFS=m` otherwise those files would not be there

Zach Zeid · Answer

Sorry I m not being clear myself I m looking at implementing CIS benchmarks for CentOS and one of the benchmarks is ` 1 1 1 1 Ensure mounting of cramfs filesystems is disabled Automated ` and the audit section says to run `modprobe` I was wondering if osquery had a way to query for such things

alessandrogario · Answer

I think this method does apply then you can test whether CONFIG SQUASHFS is set to n

alessandrogario · Answer

alessandrogario · Answer

alessandrogario · Answer

Augeas should be able to do this too but I am not too familiar with it

Zach Zeid · Answer

ok perfect thank you I ll look into it