Paranoid folks might want to completely disable the loading (and unloading) of kernel modules. Rather drastic, but hey, this way you can completely lock down the kernel space of a system (as well as render any rootkits pretty much harmless). This can be achieved in two broad ways:
- First, by setting the CONFIG_MODULES kernel config to off (it's on, of course, by default) during kernel config prior to building. Doing this is pretty drastic – it makes the decision a permanent one!
- Second, assuming CONFIG_MODULES is turned on, module loading can be dynamically turned off at runtime via the modules_disabled sysctl tunable; take a look at this:
$ cat /proc/sys/kernel/modules_disabled
0
It's off (0) by default, of course. As usual, the man page on proc(5) tells us the story:
/proc/sys/kernel/modules_disabled (since Linux 2.6.31)
A toggle value indicating if modules are allowed...
