ProtectKernelModules setting
This article has last been updated at .
The property ProtectKernelModules is a systemd unit setting used for sandboxing. It is available since systemd 232.
Purpose: define if kernel modules may be loaded
New to securing and tuning systemd services? Start with the how to harden a systemd service unit article to learn tuning step-by-step, including the usage of relevant tools.
Explanation
Kernel modules can provide additional functionality when using a modular Linux kernel, which is applicable to most systems. When this setting is set to yes, it tries to prevent the unit from loading kernel modules. This is achieved by removing the CAP_SYS_MODULE from the capability bounding set.
Generic advice
Most units do not need the permission to load kernel modules, so typically a unit can be configured with ProtectKernelModules=yes.
Values
Systemd unit setting ProtectKernelModules expects a boolean (yes/no or true/false).
| Value | Intended action | Available since systemd version |
|---|---|---|
| no | allow kernel module loading - default | |
| yes | explicit loading of kernel modules will be denied |
Example to show the current value of ProtectKernelModules for the ssh service:
systemctl show --property=ProtectKernelModules ssh.serviceRelated hardening profiles
The systemd unit setting ProtectKernelModules is used in the following systemd hardening profiles. These hardening profiles help improving security of common Linux services and usually require minimal tuning.
