Skip to main content
In this guide, you’ll learn how to restrict the use of specific Linux kernel modules to improve the security of your system. The Linux kernel follows a modular design, making it easy to extend its capabilities dynamically. For example, when new hardware is connected, the kernel automatically or manually loads the necessary module—using tools such as modprobe or insmod—to enable device support (e.g., video card drivers).

​
Loading and Listing Kernel Modules

Kernel modules are loaded as required, either manually by a system administrator or automatically by the kernel. For instance, to load the PC Speaker module manually, execute the following command as the root user:
After loading modules, you can list all active modules using:
A typical output from the lsmod command might resemble:
Be aware that an unprivileged process running inside a pod may cause some network protocol-related modules to load automatically—for example, by creating a network socket.
Due to this behavior, attackers might exploit the automatic module loading. Restricting these modules proactively enhances your system’s security posture.

​
Blacklisting Kernel Modules

To prevent potential security risks, you can blacklist kernel modules so that they are not loaded by the system—even if triggered by certain operations like network socket creation.

​
Example: Blacklisting the SCTP Module

The SCTP module is seldom used in Kubernetes clusters and is a common example to blacklist. Follow these steps to disable its loading:
  1. Create or edit a configuration file under /etc/modprobe.d/ (e.g., /etc/modprobe.d/blacklist.conf).
  2. Add the following entry to the file:
You can use any file name ending with a .conf extension as long as it is located in the /etc/modprobe.d/ directory.

​
Blacklisting Multiple Modules

To also prevent the loading of the dccp module (Datagram Congestion Control Protocol), append its entry into the same file. Once done, reboot your system and confirm that the module is no longer active:
After updating the configuration file, reboot your system to ensure changes take effect. Failure to do so might leave the module active, potentially exposing your system to security risks.
For further details on kernel module security and additional best practices, refer to section 3.4 in the CIS Benchmarks for Kubernetes.

Watch Video