0

As we are living in the Linux kernel rootkit era, Is there any way to Disable any additional module to load into operating system kernel by any user or any operation or command , in Unix? some sort of locking down the kernel space.

PS :

I know we can remove any compiler tools and some hardening, but i am looking for additional protection in Kernel space and critical files and directory in its use.

I know we could remove insmod tool in /sbin/insmod, but somebody could recopy it to OS and use it again.

  • You used the word "Linux" once in your question, but the word "UNIX" twice. Are you interested, in this question, about only the Linux OS? Or others, including IRIX, HP-UX, AIX, Solaris, etc? – Jeff Schaller Mar 10 at 13:29
2

There are several things you could do:

Block kernel module loading until the system is rebooted

Simply run echo 1 > /proc/sys/kernel/modules_disabled

After this, no new modules can be loaded for as long as the kernel is running. This setting cannot be reset back to 0 without rebooting.

This still allows loading modules at boot time, but allows you to lock it down once all the necessary modules have been loaded.

Ensure that only trustworthy modules can be loaded in the first place

These methods will allow you to have your cake and eat it too:

If your system has UEFI firmware and Secure Boot is enabled, it is actually a Secure Boot certification requirement that the bootloader must not allow unsigned kernel code to be executed. Most distributions that support Secure Boot will extend this to kernel modules too, using kernel module signing (kernel compile options CONFIG_MODULE_SIG=y and CONFIG_MODULE_SIG_FORCE=y).

Or, if you compile your own kernel, you could enable the CONFIG_SECURITY_LOADPIN kernel compilation option, which adds a requirement that all kernel modules must come from a single filesystem. This could be useful if you've segregated all user-writeable and temporary directories to separate filesystems, or even have your root filesystem read-only in locked-down use.

And of course, there is the hard-core option...

Build your own custom kernel with all the necessary drivers built-in and the module functionality entirely disabled

This is old-school, but can still be applicable if your hardware configuration is very stable.

  • Thank you for the answer , but as i understand, there is no way to disable it permanently in the running server. – comey macdonald Mar 10 at 10:27
  • @comeymacdonald did you try the modules_disabled method? If you set that value at boot-time, it seems to me that would be pretty effective. Also, disabling module support in the kernel sounds like a "permanent disablement " to me as well. How do you see these differently? – Jeff Schaller Mar 10 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.