Accurate Run-time Kernel Module Checking
Mike Palmiotto
mpalmiotto at tresys.com
Mon Aug 27 18:34:29 UTC 2012
All,
Just wondering what the community thinks about the appropriate standard
for disable kernel modules. All of these solutions seem valuable in
their own right, but as far as I know, none of them ensure the actual
presence/absence of kernel modules at run-time.
1) rdblacklist=[kernel_module]
- I know this only prevents loading of the module in the rd=ramdisk,
but how does this affect dracut at runtime?
2) /etc/modprobe.d blacklists
- This approach is very similar to /bin/true.
3) install kernel_module /bin/true
- This ensures that an entry in a textfile is present, but what if
someone runs insmod on a kernel_module? This will not reflect the true
status of the kernel module in the system.
4) /proc/ksyms
- Seems to be the most accurate reflection of the current system
status, though I'm no expert, so call me out on this.
I look forward to your input.
--Mike
More information about the scap-security-guide
mailing list