ProtectKernelModules setting
This systemd unit setting was added since systemd 232.
Purpose: define if kernel modules may be loaded
Explanation
Kernel modules can provide additional functionality when using a modular Linux kernel, which is applicable to most systems. When this setting is set to yes, it tries to prevent the unit from loading kernel modules. This is achieved by removing the CAP_SYS_MODULE from the capability bounding set.
Generic advice
Most units do not need the permission to load kernel modules, so typically a unit can be configured with ProtectKernelModules=true.
Values
This setting expects a boolean (yes or no).
- no: allow kernel module loading - default
- yes: explicit loading of kernel modules will be denied
Example to show the current value of ProtectKernelModules for the dmesg service:
systemctl show --property=ProtectKernelModules dmesg.service
