5

Can someone please tell me why the following command

modprobe -n -v dccp_ipv4

returns two results ?

install /bin/true
install /bin/true

And why does

modprobe -n -v dccp_ipv6

returns three ?

install /bin/true
install /bin/true
install /bin/true

I'm on CentOS Linux release 7.3.1611 (Core), and in /etc/modprobe.d I have a number of files, among which a file with recommendations from CIS. This file contains (among others) :

install dccp_ipv4 /bin/true
install dccp_ipv6 /bin/true

Above two are the only occurences in the files in /etc/modprobe.d

Furthermore, a

modprobe -n -v udf

returns two lines as well :

insmod /lib/modules/3.10.0-514.21.2.el7.x86_64/kernel/lib/crc-itu-t.ko
install /bin/true

The content of the CIS file in /etc/modprobe.d is:

install udf /bin/true

So, why the insmod line ?

I'm asking this because a vulnerability scanner expects only one line of output (in this case install /bin/true)

1 Answer 1

5

There are multiple results as there are multiple dependances: modinfo -F depends <module_name> will list the dependancies for that module.

eg:

$ modprobe -n -v dccp_ipv6                                  
insmod /lib/modules/3.10.0-514.el7.x86_64/kernel/net/dccp/dccp.ko            
insmod /lib/modules/3.10.0-514.el7.x86_64/kernel/net/dccp/dccp_ipv4.ko    
insmod /lib/modules/3.10.0-514.el7.x86_64/kernel/net/dccp/dccp_ipv6.ko 

So, why the insmod line ?

The udf module depends on udf and crc-itu-t and the crc-itu-t is enabled for loading, hence the insmod line.

The install /bin/true indicates that the module is disabled - which is what your scanner is looking for.

For me this behaviour is the same on CentOS 6.8 and 7.1.

1
  • Thanks. That explains a lot. I believe the scanner must be using the wrong regexp to test, because, even though the line install /bin/true is present, it also sees the other line(s) and then fails..... Commented Sep 15, 2017 at 7:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .