3

Can someone please tell me why the following command

modprobe -n -v dccp_ipv4

returns two results ?

install /bin/true
install /bin/true

And why does

modprobe -n -v dccp_ipv6

returns three ?

install /bin/true
install /bin/true
install /bin/true

I'm on CentOS Linux release 7.3.1611 (Core), and in /etc/modprobe.d I have a number of files, among which a file with recommendations from CIS. This file contains (among others) :

install dccp_ipv4 /bin/true
install dccp_ipv6 /bin/true

Above two are the only occurences in the files in /etc/modprobe.d

Furthermore, a

modprobe -n -v udf

returns two lines as well :

insmod /lib/modules/3.10.0-514.21.2.el7.x86_64/kernel/lib/crc-itu-t.ko
install /bin/true

The content of the CIS file in /etc/modprobe.d is:

install udf /bin/true

So, why the insmod line ?

I'm asking this because a vulnerability scanner expects only one line of output (in this case install /bin/true)

2

There are multiple results as there are multiple dependances: modinfo -F depends <module_name> will list the dependancies for that module.

eg:

$ modprobe -n -v dccp_ipv6
insmod /lib/modules/3.10.0-514.el7.x86_64/kernel/net/dccp/dccp.ko
insmod /lib/modules/3.10.0-514.el7.x86_64/kernel/net/dccp/dccp_ipv4.ko
insmod /lib/modules/3.10.0-514.el7.x86_64/kernel/net/dccp/dccp_ipv6.ko

So, why the insmod line ?

The udf module depends on udf and crc-itu-t and the crc-itu-t is enabled for loading, hence the insmod line.

The install /bin/true indicates that the module is disabled - which is what your scanner is looking for.

For me this behaviour is the same on CentOS 6.8 and 7.1.

hth

  • Thanks. That explains a lot. I believe the scanner must be using the wrong regexp to test, because, even though the line install /bin/true is present, it also sees the other line(s) and then fails..... – notaverygoodprogrammer Sep 15 '17 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.