LowOS hardeningBLWK-KERNEL-020

Kernel module not blacklisted: ‹module›

What this means

The ‹module› kernel module isn't blacklisted in /etc/modprobe.d/, meaning it can still be auto-loaded on demand — simply by an unprivileged process opening a socket of that family. All four of these network protocol modules (dccp, sctp, rds, tipc) have a documented history of local-privilege-escalation vulnerabilities reachable exactly that way, and essentially no host actually uses them. usb-storage is deliberately NOT covered here — it's a different threat (physical-media exfiltration/BadUSB, not remote exploitation) and the remediation is destructive on a workstation, so it lives in BLWK-KERNEL-021 behind the server profile.

How to fix it

If ‹module› isn't actually needed on this host, add install ‹module› /bin/true to a file under /etc/modprobe.d/ (e.g. /etc/modprobe.d/blacklist-rare.conf) and run update-initramfs -u.

Check it yourself

Run a scan and look for BLWK-KERNEL-020 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads module_blacklist and reports this check when:

blacklisted == false and loadable == true and module != "usb-storage"

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 1.1.1

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001