Kernel Modules¶

The kernel loads drivers on demand. Every driver is kernel code, and some of them are for filesystems and protocols nobody has used in years but that still get loaded the moment something asks. The benchmark blocks the ones with a history of bugs and no job on a modern desktop (CIS 1.1.1.x, 3.2.x).

The list¶

Module	What it is	Level
`cramfs`, `freevxfs`, `hfs`, `hfsplus`, `jffs2`	Filesystems for compressed ROM images, old Veritas disks, classic Mac disks, and flash chips (1.1.1.1 to 1.1.1.5)	1
`overlay`, `squashfs`, `udf`	Container layering, compressed read-only images, optical media (1.1.1.6 to 1.1.1.8)	2 (Flatpak and some live tools need `squashfs` or `overlay`; check the README)
`usb-storage`	USB drives (1.1.1.9)	2 (blocks every USB stick; only if the README doesn't need them)
`dccp`, `tipc`, `rds`, `sctp`	Network protocols (3.2.1 to 3.2.4)	1
`firewire-core`	FireWire, which allows direct memory access from a plugged-in device (Debian CIS 1.1.1.9)	1 on a server, 2 on a workstation
`atm`, `can`	ATM networking and the automotive CAN bus (Debian CIS 3.2.1, 3.2.2)	1
Wireless drivers	On a server, every module under `drivers/net/wireless` (Debian CIS 3.1.2)	1, server only
Anything else in `1.1.1.10`'s spirit: `gfs2`, `afs`, `ceph`, `nfs` when unused	Unused filesystems	1, by judgement

Block a module¶

Two lines in a file under /etc/modprobe.d/ do it. install name /bin/false makes any attempt to load the module run /bin/false instead, and blacklist name stops it loading automatically when a device appears. Do the first one by hand:

sudo nano /etc/modprobe.d/60-cramfs.conf

install cramfs /bin/false
blacklist cramfs

sudo modprobe -r cramfs
modprobe -n -v cramfs

The last command is a dry run; it should now print install /bin/false. Repeat for the rest of the Level 1 list, one file each. After the third one you'll have the pattern memorized and will want a loop; writing one is a two-minute exercise in for m in …; do …; done with printf and tee, and it's a tool you can carry to the next image. Level 2 modules only when the README allows.

modprobe -r fails if the module is in use (a mounted USB drive, a running Flatpak); that's the signal to leave that one alone.

On a Debian server with no legitimate Wi-Fi (the README will say if there is), the wireless drivers are a whole directory of modules. ls /lib/modules/$(uname -r)/kernel/drivers/net/wireless shows them, and the same two-line pattern per module blocks them; the loop you wrote above handles a list that long.

What's loaded now¶

lsmod | grep -E 'cramfs|freevxfs|hfs|jffs2|udf|squashfs|dccp|tipc|rds|sctp|usb_storage'

A rootkit is a kernel module too. lsmod lists everything loaded; a name you don't recognize deserves modinfo name (a module with no signer, no description, or a path outside /lib/modules is not from the distribution). The Kernel Hardening page's modules_disabled locks the list once you're done.

Verify¶

modprobe -n -v hfsplus
modprobe -n -v sctp

Each prints install /bin/false, which means the block is in place. Check every module on the list; if you wrote the loop above, a second loop that runs modprobe -n -v for each is the verify half of your tool.

Example¶

lsmod shows sctp loaded and modprobe -n -v cramfs prints insmod /lib/modules/.../cramfs.ko, so nothing is blocked. Write the nine Level 1 files and unload sctp. The README says the machine is used with USB backup drives, so usb-storage stays.

Try it¶

Block cramfs by hand and confirm with modprobe -n -v.
Load sctp with modprobe sctp, find it in lsmod, unload it, block it.

Build it¶

The loop this page describes: a modules.sh that takes a list of module names and writes the two-line file for each, unloads it, and prints the modprobe -n -v result.

Next¶

AppArmor