{"id":662,"date":"2012-11-28T15:55:07","date_gmt":"2012-11-28T23:55:07","guid":{"rendered":"http:\/\/www.outflux.net\/blog\/?p=662"},"modified":"2012-11-28T16:02:38","modified_gmt":"2012-11-29T00:02:38","slug":"clean-module-disabling","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2012\/11\/28\/clean-module-disabling\/","title":{"rendered":"clean module disabling"},"content":{"rendered":"

I think I found a way to make disabling kernel module loading (via \/proc\/sys\/kernel\/modules_disabled<\/code>) easier for server admins. Right now there’s kind of a weird problem on some distros where reading \/etc\/modules<\/code> races with reading \/etc\/sysctl.{conf,d}<\/code>. In these cases, you can’t just put “kernel.modules_disabled=1<\/code>” in the latter since you might not have finished loading modules from \/etc\/modules<\/code>.<\/p>\n

Before now, on my own systems, I’d added the sysctl call to my \/etc\/rc.local<\/code>, which seems like a hack — that file is related to neither sysctl nor modules and both subsystems have their own configuration files, but it does happen absolutely last.<\/p>\n

Instead, I’ve now defined “disable<\/code>” as a modprobe alias via \/etc\/modprobe.d\/disable.conf<\/code>:<\/p>\n

\r\n# To disable module loading after boot, \"modprobe disable\" can be used to\r\n# set the sysctl that controls module loading.\r\ninstall disable \/sbin\/sysctl kernel.modules_disabled=1\r\n<\/pre>\n
And then in \/etc\/modules<\/code> I can list all the modules I actually need, and then put “disable<\/code>” on the last line. (Or, if I want to not remember the sysctl path, I can manually run “modprobe disable<\/code>” to turn off modules at some later point.)<\/p>\n
I think it’d be cool this this become an internal alias in upstream kmod.<\/p>\n
© 2012, Kees Cook<\/a>. This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License<\/a>.
\"CC<\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"
I think I found a way to make disabling kernel module loading (via \/proc\/sys\/kernel\/modules_disabled) easier for server admins. Right now there’s kind of a weird problem on some distros where reading \/etc\/modules races with reading \/etc\/sysctl.{conf,d}. In these cases, you can’t just put “kernel.modules_disabled=1” in the latter since you might not have finished loading modules […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,20,6,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/662"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=662"}],"version-history":[{"count":7,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/662\/revisions"}],"predecessor-version":[{"id":667,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/662\/revisions\/667"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=662"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=662"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}