31.5. Blacklisting a Module
/etc/modprobe.d/directory as root:
/etc/modprobe.d/blacklist.conffile that already exists on the system by default. However, the preferred method is to create a separate configuration file,
/etc/modprobe.d/<module_name>.conf, that will contain settings specific only to the given kernel module.
Example 31.4. An example of /etc/modprobe.d/blacklist.conf
# # Listing a module here prevents the hotplug scripts from loading it. # Usually that'd be so that some other driver will bind it instead, # no matter which driver happens to get probed first. Sometimes user # mode tools can also control driver binding. # # Syntax: see modprobe.conf(5). # # watchdog drivers blacklist i8xx_tco # framebuffer drivers blacklist aty128fb blacklist atyfb blacklist radeonfb blacklist i810fb blacklist cirrusfb blacklist intelfb blacklist kyrofb blacklist i2c-matroxfb blacklist hgafb blacklist nvidiafb blacklist rivafb blacklist savagefb blacklist sstfb blacklist neofb blacklist tridentfb blacklist tdfxfb blacklist virgefb blacklist vga16fb blacklist viafb # ISDN - see bugs 154799, 159068 blacklist hisax blacklist hisax_fcpcipnp # sound drivers blacklist snd-pcsp # I/O dynamic configuration support for s390x (bz #563228) blacklist chsc_sch
blacklist <module_name>command, however, does not prevent the module from being loaded manually, or from being loaded as a dependency for another kernel module that is not blacklisted. To ensure that a module cannot be loaded on the system at all, modify the specified configuration file in the
/etc/modprobe.d/directory as root with the following line:
install <module_name> /bin/true
Example 31.5. Using module blacklisting as a temporary problem solution
pppol2pt) has been found, and this flaw could be misused to compromise your system. If your system does not require the
pppol2ptmodule to function, you can follow this procedure to blacklist
pppol2ptcompletely until this problem is fixed:
- Verify whether
pppol2ptis currently loaded in the kernel by running the following command:
lsmod | grep ^pppol2tp && echo "The module is loaded" || echo "The module is not loaded"
- If the module is loaded, you need to unload it and all its dependencies to prevent its possible misuse. See Section 31.4, “Unloading a Module” for instructions on how to safely unload it.
- Run the following command to ensure that
pppol2ptcannot be loaded to the kernel:
echo "install pppol2tp /bin/true" > /etc/modprobe.d/pppol2tp.confNote that this command overwrites the content of the
/etc/modprobe.d/pppol2tp.conffile if it already exists on your system. Check and back up your existing
pppol2tp.confbefore running this command. Also, if you were unable to unload the module, you have to reboot the system for this command to take effect.
pppol2ptmodule has been properly fixed, you can delete the
/etc/modprobe.d/pppol2tp.conffile or restore its previous content, which will allow your system to load the
pppol2ptmodule with its original configuration.