Accurate Run-time Kernel Module Checking

Mike Palmiotto mpalmiotto at tresys.com
Mon Aug 27 18:34:29 UTC 2012


All,

Just wondering what the community thinks about the appropriate standard 
for disable kernel modules.  All of these solutions seem valuable in 
their own right, but as far as I know, none of them ensure the actual 
presence/absence of kernel modules at run-time.

1) rdblacklist=[kernel_module]
	- I know this only prevents loading of the module in the rd=ramdisk, 
but how does this affect dracut at runtime?

2) /etc/modprobe.d blacklists
	- This approach is very similar to /bin/true.

3) install kernel_module /bin/true
	- This ensures that an entry in a textfile is present, but what if 
someone runs insmod on a kernel_module?  This will not reflect the true 
status of the kernel module in the system.

4) /proc/ksyms
	- Seems to be the most accurate reflection of the current system 
status, though I'm no expert, so call me out on this.

I look forward to your input.

--Mike



More information about the scap-security-guide mailing list