Block network file systems

Why it matters

Mounting a network share means the kernel talks to a remote server using code that parses data the server sends. A malicious or compromised server can try to exploit bugs in that code. If you never use such shares, you do not need the code loaded at all.

How it works

Adds a modprobe configuration that blocks the modules in the network-filesystems group, which cover NFS and SMB/CIFS clients. Attempts to mount such shares then fail because the driver cannot be loaded.

Who should use it

Only if you never mount NFS or SMB shares, which is true for many laptops. Leave it off if you use a NAS, a company file server or any NFS home directory.

What you may notice

Mounting a share fails with an error such as unknown filesystem type nfs or cifs. If a mounted share is missing after boot, this is a likely cause.

Check it on your computer

See whether the modules are loaded:

lsmod | grep -E '^(cifs|nfs|nfsv3|nfsv4|ksmbd|gfs2) '

Apply it by hand

Tell the system not to load them, in a file you own:

sudo tee /etc/modprobe.d/90-modules-network-filesystems.conf <<'EOF'
install cifs /bin/true
install nfs /bin/true
install nfsv3 /bin/true
install nfsv4 /bin/true
install ksmbd /bin/true
install gfs2 /bin/true
EOF

Undo it

Remove the file. Modules already loaded stay until the next restart.

Related settings

• Block rarely used file systems

Sources

Linux Hardening Guide (madaidans)

2.5.2