Skip to content
ATO Pathways
  Log In

Disable loading and unloading of kernel modules

An XCCDF Rule

Description

To set the runtime status of the kernel.modules_disabled kernel parameter, run the following command: 

$ sudo sysctl -w kernel.modules_disabled=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: 
kernel.modules_disabled = 1

warning alert: Warning

This rule doesn't come with Bash remediation. Remediating this rule during the installation process disrupts the install and boot process.

Rationale

Malicious kernel modules can have a significant impact on system security and availability. Disabling loading of kernel modules prevents this threat. Note that once this option has been set, it cannot be reverted without doing a system reboot. Make sure that all needed kernel modules are loaded before setting this option.

ID
xccdf_org.ssgproject.content_rule_sysctl_kernel_modules_disabled
Severity
Medium
References
Updated



Remediation - Ansible

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/