{"id":230,"date":"2009-07-31T11:47:38","date_gmt":"2009-07-31T19:47:38","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=230"},"modified":"2009-07-31T11:58:13","modified_gmt":"2009-07-31T19:58:13","slug":"blocking-module-loading","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2009\/07\/31\/blocking-module-loading\/","title":{"rendered":"blocking module loading"},"content":{"rendered":"

New for Linux 2.6.31 (and Ubuntu 9.10) is the ability to throw a one-way toggle<\/a> to block module loading via \/proc\/sys\/kernel\/modules_disabled<\/code>:<\/p>\n

# uname -a<\/strong>
\nLinux sec-karmic-amd64 2.6.31-4-generic #23-Ubuntu SMP Mon Jul 27 18:39:59 UTC 2009 x86_64 GNU\/Linux
\n# lsmod | head -n3<\/strong>
\nModule Size Used by
\nbinfmt_misc 10220 1
\nppdev 8200 0
\n# cat \/proc\/sys\/kernel\/modules_disabled<\/strong>
\n0
\n# modprobe usb-storage<\/strong>
\n# lsmod | head -n3<\/strong>
\nModule Size Used by
\nusb_storage 65600 0
\nbinfmt_misc 10220 1
\n# echo 1 > \/proc\/sys\/kernel\/modules_disabled<\/strong>
\n# rmmod usb-storage<\/strong>
\nERROR: Removing 'usb_storage': Operation not permitted
\n# modprobe zlib_deflate<\/strong>
\nFATAL: Error inserting zlib_deflate (\/lib\/modules\/2.6.31-4-generic\/kernel\/lib\/zlib_deflate\/zlib_deflate.ko): Operation not permitted
\n# echo 0 > \/proc\/sys\/kernel\/modules_disabled<\/strong>
\nbash: echo: write error: Invalid argument
\n# cat \/proc\/sys\/kernel\/modules_disabled<\/strong>
\n1
\n<\/code><\/p>\n

The intent is for this to allow paranoid server admins (or other people not expecting to hot-plug new hardware or kernel services) the ability to block module loading without compiling a monolithic kernel.<\/p>\n

This kind of thing used to be available<\/a> through the “lcap” utility modifying the global capability bounding set (which was removed in 2.6.25), but init could always be made to turn it back on.<\/p>\n

Combined with the removal of \/dev\/kmem<\/a> and the hardening of \/dev\/mem<\/a>, this closes another kernel rootkit door. It’s not a cure-all, but it’s another layer.<\/p>\n

Now we just have to figure out ways to stamp out unexpected ioport-triggered DMA access.<\/p>\n

© 2009, Kees Cook<\/a>. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License<\/a>.
\"CC<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"

New for Linux 2.6.31 (and Ubuntu 9.10) is the ability to throw a one-way toggle to block module loading via \/proc\/sys\/kernel\/modules_disabled: # uname -a Linux sec-karmic-amd64 2.6.31-4-generic #23-Ubuntu SMP Mon Jul 27 18:39:59 UTC 2009 x86_64 GNU\/Linux # lsmod | head -n3 Module Size Used by binfmt_misc 10220 1 ppdev 8200 0 # cat \/proc\/sys\/kernel\/modules_disabled […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,18,6,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/230"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=230"}],"version-history":[{"count":7,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/230\/revisions"}],"predecessor-version":[{"id":236,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/230\/revisions\/236"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=230"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=230"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=230"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}