{
  "id": "CB-UBU-FS-002",
  "standard": "ubuntu",
  "version": "0.1.2",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-FS-002",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-FS-002.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-FS-002.yml",
  "profiles_effective": [
    "server",
    "server-hardened",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-FS-002",
    "title": "Block USB mass storage and FireWire kernel modules",
    "finding": {
      "title": "USB storage devices and FireWire can be used on the system",
      "description": "Anyone with physical access can copy data to a USB disk, bring in tools, or use FireWire direct memory access."
    },
    "status": "active",
    "profiles": [
      "server",
      "desktop-hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "kernel-modules",
      "usb",
      "firewire",
      "modprobe"
    ],
    "description": "`usb-storage` is the driver for USB disks and keys, `firewire-core` the base of the FireWire\n(IEEE 1394) stack. This control blocks the modules listed in `{{ modules }}`: each one gets an\n`install <module> /bin/false` rule, so any load attempt fails, and a `blacklist` rule. A module\nthat no installed kernel ships is compliant.\n",
    "rationale": "Removable storage is a common way to take data out of a system and to bring malware in.\nFireWire controllers can read and write host memory directly, which lets a device extract keys\nor bypass the login. A server rarely needs either.\n",
    "impact": "USB disks and keys are no longer usable. Keyboards, mice and other USB devices keep working.\nOn a hardened workstation, use the network or an approved channel to exchange files, or remove\n`usb-storage` from `{{ modules }}` and control devices with USBGuard instead.\n",
    "notes": "The Ubuntu generic kernel ships `usb-storage` in `linux-modules` on every release, so the check\nfails until the fix runs. `firewire-core` comes with `linux-modules-extra` on 20.04 to 24.04\n(not installed on cloud and minimal images) and with `linux-modules` on 26.04. Ubuntu's own\n`/etc/modprobe.d/blacklist-firewire.conf` only names the old ieee1394 drivers (`ohci1394`,\n`sbp2`...), not the current FireWire stack.\n`uas` (USB Attached SCSI) depends on `usb-storage` and is blocked with it.\n",
    "setting": {
      "location": "/etc/modprobe.d/60-cirsec-usb-firewire.conf",
      "default_value": "USB storage and FireWire modules load when a device is plugged in",
      "recommended_value": "install /bin/false and blacklist for: {{ modules }}"
    },
    "parameters": [
      {
        "name": "modules",
        "type": "list",
        "description": "Kernel modules to block, as named by modprobe.",
        "default": [
          "usb-storage",
          "firewire-core"
        ]
      }
    ],
    "audit": {
      "manual": "For each module of `{{ modules }}`:\n1. `modprobe --showconfig | grep -E '^(install|blacklist) <module>'` must show\n   `install <module> /bin/false` and `blacklist <module>` (dashes appear as underscores), or\n   `find /lib/modules -name '<module>.ko*'` must find nothing.\n2. `grep '^<module> ' /proc/modules` (with underscores) must find nothing.\n",
      "checks": [
        {
          "id": "modules",
          "engine": "shell",
          "description": "Each listed module is blocked in the modprobe configuration, or not shipped, and not loaded.",
          "spec": {
            "script": "cfg=$(modprobe --showconfig 2>/dev/null) || exit 3\nrc=0\nfor m in $CB_MODULES; do\n  n=$(printf '%s' \"$m\" | tr - _)\n  if grep -q \"^$n \" /proc/modules; then\n    echo \"$m: loaded\"; rc=1; continue\n  fi\n  if printf '%s\\n' \"$cfg\" | grep -Eq \"^install $n (/usr)?/bin/(false|true)( |\\$)\" &&\n    printf '%s\\n' \"$cfg\" | grep -qx \"blacklist $n\"; then\n    echo \"$m: blocked\"\n  elif [ -z \"$(find /lib/modules/ \\( -name \"$m.ko*\" -o -name \"$n.ko*\" \\) 2>/dev/null | head -n 1)\" ] &&\n    ! grep -qs \"/$n.ko\\$\\|/$m.ko\\$\" /lib/modules/*/modules.builtin; then\n    echo \"$m: not shipped by any installed kernel\"\n  else\n    echo \"$m: can be loaded\"; rc=1\n  fi\ndone\nexit $rc\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "1. Create `/etc/modprobe.d/60-cirsec-usb-firewire.conf` with, for each module of `{{ modules }}`:\n   ```\n   install <module> /bin/false\n   blacklist <module>\n   ```\n2. Unplug the devices and unload the modules with `modprobe -r <module>`, or reboot.\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": false
      },
      "rollback": "Delete `/etc/modprobe.d/60-cirsec-usb-firewire.conf`. The modules load again when a device is plugged in.\n",
      "scripts": [
        {
          "id": "modprobe-conf",
          "engine": "shell",
          "content": "f=/etc/modprobe.d/60-cirsec-usb-firewire.conf\ncb_backup \"$f\"\n{\n  echo '# Written by CIRSEC Baselines CB-UBU-FS-002'\n  for m in $CB_MODULES; do printf 'install %s /bin/false\\nblacklist %s\\n' \"$m\" \"$m\"; done\n} >\"$f\"\nchmod 644 \"$f\"\nrc=0\nfor m in $CB_MODULES; do\n  n=$(printf '%s' \"$m\" | tr - _)\n  grep -q \"^$n \" /proc/modules || continue\n  modprobe -r \"$n\" || { echo \"$m is in use, it stays loaded until reboot\" >&2; rc=1; }\ndone\nexit $rc\n"
        }
      ]
    },
    "references": [
      {
        "title": "modprobe.d(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/modprobe.d.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "Linux kernel documentation - Using physical DMA provided by OHCI-1394 FireWire controllers for debugging",
        "url": "https://docs.kernel.org/core-api/debugging-via-ohci1394.html",
        "publisher": "The Linux Kernel Organization",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "MP-7",
        "relation": "partial"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1052.001"
      },
      {
        "framework": "mitre-attack",
        "id": "T1200"
      },
      {
        "framework": "mitre-attack",
        "id": "T1091"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-FS-001",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM 2520, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Fails on fresh install (usb-storage shipped); fix writes the modprobe rules, modprobe then refuses usb-storage; kept after reboot; server-hardened profile."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM 2522, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Fails on fresh install (usb-storage shipped); fix writes the modprobe rules, modprobe then refuses usb-storage; kept after reboot; server-hardened profile."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM 2524, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Fails on fresh install (usb-storage shipped); fix writes the modprobe rules, modprobe then refuses usb-storage; kept after reboot; server-hardened profile."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM 2526, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Fails on fresh install (usb-storage shipped); fix writes the modprobe rules, modprobe then refuses usb-storage; kept after reboot; server-hardened profile."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}