ProtectKernelModules setting

The property ProtectKernelModules is a systemd unit setting used for sandboxing. It is available since systemd 232.

Purpose: define if kernel modules may be loaded

Explanation

Kernel modules can provide additional functionality when using a modular Linux kernel, which is applicable to most systems. When this setting is set to yes, it tries to prevent the unit from loading kernel modules. This is achieved by removing the CAP_SYS_MODULE from the capability bounding set.

Generic advice

Most units do not need the permission to load kernel modules, so typically a unit can be configured with ProtectKernelModules=yes.

Values

Systemd unit setting ProtectKernelModules expects a boolean (yes/no or true/false).

Values for systemd unit setting ProtectKernelModules
Value	Intended action	Available since systemd version
no	allow kernel module loading - default
yes	explicit loading of kernel modules will be denied

Example to show the current value of ProtectKernelModules for the ssh service:

systemctl show --property=ProtectKernelModules ssh.service

Related hardening profiles

The systemd unit setting ProtectKernelModules is used in the following hardening profiles.

Frequently Asked Questions

How to use systemctl edit?

Run systemctl with the 'edit' subcommand and service.

systemctl edit UNIT.service

See full answer at How to use systemctl edit to change a service?

Like to learn more? Here is a list of articles within the same category or having similar tags.

Feedback

This article has been written by our Linux security expert Michael Boelen. With focus on creating high-quality articles and relevant examples, he wants to improve the field of Linux security. No more web full of copy-pasted blog posts.

Discovered outdated information or have a question? Share your thoughts. Thanks for your contribution!