In this lesson, you will learn how to harden your Linux system by preventing non-privileged users from loading arbitrary kernel modules, a common tactic used for rootkit persistence.
The Problem with Module Loading
Under default configurations, users with sudo privileges or those with specific capabilities can execute insmod or modprobe to insert code directly into the kernel. If an attacker gains elevated access, they can load malicious drivers to hide processes, sniff network traffic, or bypass system-wide security controls. To mitigate this, we must restrict who can interact with the kernel’s module subsystem.
Using Kernel Capabilities
The primary gatekeeper for kernel module operations is the CAP_SYS_MODULE capability. By default, processes (including shells) do not possess this unless they are running as root. However, we can enforce stricter limits by leveraging kernel parameters.
To prevent anyone—even root—from loading modules after the system has booted, you can set the kernel.modules_disabled sysctl parameter:
# Disable kernel module loading until the next reboot
sysctl -w kernel.modules_disabled=1
Once this is set to 1, any attempt to load or unload a module will be blocked, effectively locking down the kernel’s interface.
Integrating with PAM
While sysctl manages the system state, we can use PAM to enforce security policies during login. If you want to ensure that specific users are never granted privileges that could lead to module manipulation, you can use the pam_cap.so module to strictly manage what capabilities are assigned to a session.
By adding a rule to your PAM configuration (e.g., /etc/pam.d/common-auth), you can strip CAP_SYS_MODULE from user sessions entirely:
auth required pam_cap.so keepcaps
Combined with a policy that denies sudo rights to non-essential users, this creates a layered defense. By strictly controlling both the kernel's state and the user’s capability set, you ensure that even if an account is compromised, the attacker cannot easily extend their reach by inserting malicious kernel-level code.
Key Takeaway: By disabling kernel.modules_disabled and enforcing strict capability management via PAM, you effectively neutralize the risk of unauthorized kernel module injection.