Zach Zeid
08/17/2022, 11:30 AMalessandrogario
Zach Zeid
08/17/2022, 1:55 PMalessandrogario
CONFIG_FEATURE_NAME
and may indicate whether it's built-in, module, or off completely$ grep SQUASH /boot/config-5.18.13-200.fc36.x86_64
CONFIG_SQUASHFS=m
# CONFIG_SQUASHFS_FILE_CACHE is not set
CONFIG_SQUASHFS_FILE_DIRECT=y
# CONFIG_SQUASHFS_DECOMP_SINGLE is not set
# CONFIG_SQUASHFS_DECOMP_MULTI is not set
CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
CONFIG_SQUASHFS_XATTR=y
CONFIG_SQUASHFS_ZLIB=y
CONFIG_SQUASHFS_LZ4=y
CONFIG_SQUASHFS_LZO=y
CONFIG_SQUASHFS_XZ=y
CONFIG_SQUASHFS_ZSTD=y
# CONFIG_SQUASHFS_4K_DEVBLK_SIZE is not set
# CONFIG_SQUASHFS_EMBEDDED is not set
CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3
$ find /lib/modules -type f -iname '*squash*.ko*'
/lib/modules/5.18.13-200.fc36.x86_64/kernel/fs/squashfs/squashfs.ko.xz
/lib/modules/5.18.16-200.fc36.x86_64/kernel/fs/squashfs/squashfs.ko.xz
/lib/modules/5.18.17-200.fc36.x86_64/kernel/fs/squashfs/squashfs.ko.xz
CONFIG_SQUASHFS=m
otherwise those files would not be thereZach Zeid
08/17/2022, 2:13 PM"_1.1.1.1 Ensure mounting of cramfs filesystems is disabled (Automated)"
, and the audit section says to run modprobe
. I was wondering if osquery had a way to query for such things._alessandrogario
Zach Zeid
08/17/2022, 3:24 PM