Disable loading and unloading of kernel modules

An XCCDF Rule

Description

To set the runtime status of the kernel.modules_disabled kernel parameter, run the following command:

$ sudo sysctl -w kernel.modules_disabled=1

To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d:

kernel.modules_disabled = 1

warning alert: Warning

This rule doesn't come with Bash remediation. Remediating this rule during the installation process disrupts the install and boot process.

Rationale

Malicious kernel modules can have a significant impact on system security and availability. Disabling loading of kernel modules prevents this threat. Note that once this option has been set, it cannot be reverted without doing a system reboot. Make sure that all needed kernel modules are loaded before setting this option.

ID: xccdf_org.ssgproject.content_rule_sysctl_kernel_modules_disabled
Severity: Medium
References: BP28(R24)

CCE-91566-0
Updated: about 1 year ago

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /run/sysctl.d/
    - /etc/sysctl.d/
    - /usr/local/lib/sysctl.d/    - /lib/sysctl.d/
    contains: ^[\s]*kernel.modules_disabled.*$
    patterns: '*.conf'
    file_type: any
  register: find_sysctl_d
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CCE-91566-0
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_modules_disabled

- name: Comment out any occurrences of kernel.modules_disabled from config files
  replace:
    path: '{{ item.path }}'
    regexp: ^[\s]*kernel.modules_disabled
    replace: '#kernel.modules_disabled'
  loop: '{{ find_sysctl_d.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CCE-91566-0
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_modules_disabled

- name: Comment out any occurrences of kernel.modules_disabled from /etc/sysctl.conf
  replace:
    path: /etc/sysctl.conf
    regexp: ^[\s]*kernel.modules_disabled
    replace: '#kernel.modules_disabled'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CCE-91566-0
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_modules_disabled

- name: Ensure sysctl kernel.modules_disabled is set to 1
  sysctl:
    name: kernel.modules_disabled
    value: '1'
    sysctl_file: /etc/sysctl.d/kernel_modules_disabled.conf
    state: present
    reload: true
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CCE-91566-0
  - disable_strategy
  - low_complexity
  - medium_disruption
  - medium_severity
  - reboot_required
  - sysctl_kernel_modules_disabled

Disable loading and unloading of kernel modules

Description

Rationale

Remediation - Ansible