Note:
- This tutorial is available in an Oracle-provided free lab environment.
- It uses example values for Oracle Cloud Infrastructure credentials, tenancy, and compartments. When completing your lab, substitute these values with ones specific to your cloud environment.
Disable a Kernel Module on Oracle Linux
Introduction
As a Linux administrator, there will come a time when you want to disable kernel modules for hardware that might be causing a problem on a system, or it gets flagged for a vulnerability.
Objectives
In this tutorial, you will learn how to:
- Disable a module using modprobe
- Add the module to the kernel module deny list
- Create a backup of the existing initramfs
- Rebuild the initramfs by using dracut to exclude the module
Note: Disabling modules can have unintended consequences and prevent a system from booting properly or being fully functional after boot. Therefore, we’ll demonstrate creating a backup ramdisk image as best practice to ensure you can recover if a change prevents booting the operating system.
Prerequisites
-
Minimum of a single Oracle Linux system
-
Each system should have Oracle Linux installed and configured with:
- A non-root user account with sudo access
- Access to the Internet
Deploy Oracle Linux
Note: If running in your own tenancy, read the linux-virt-labs
GitHub project README.md and complete the prerequisites before deploying the lab environment.
-
Open a terminal on the Luna Desktop.
-
Clone the
linux-virt-labs
GitHub project.git clone https://github.com/oracle-devrel/linux-virt-labs.git
-
Change into the working directory.
cd linux-virt-labs/ol
-
Install the required collections.
ansible-galaxy collection install -r requirements.yml
-
Deploy the lab environment.
ansible-playbook create_instance.yml -e localhost_python_interpreter="/usr/bin/python3.6"
The free lab environment requires the extra variable
local_python_interpreter
, which setsansible_python_interpreter
for plays running on localhost. This variable is needed because the environment installs the RPM package for the Oracle Cloud Infrastructure SDK for Python, located under the python3.6 modules.The default deployment shape uses the AMD CPU and Oracle Linux 8. To use an Intel CPU or Oracle Linux 9, add
-e instance_shape="VM.Standard3.Flex"
or-e os_version="9"
to the deployment command.Important: Wait for the playbook to run successfully and reach the pause task. At this stage of the playbook, the installation of Oracle Linux is complete, and the instances are ready. Take note of the previous play, which prints the public and private IP addresses of the nodes it deploys and any other deployment information needed while running the lab.
List the Module
For demonstration purposes in this tutorial, we use the joydev module, but you could use the same procedure to disable any other Linux kernel module on a system.
-
Open a terminal and connect via SSH to the ol-node-01 instance.
ssh oracle@<ip_address_of_instance>
-
Check if the system automatically loads the module.
lsmod | grep joydev
-
Get information about the module.
modinfo joydev | head -n 4
The output shows the first four lines of the module’s information and states this module is for joystick device interfaces.
Disable the Module
-
Unload the module from the running system.
sudo modprobe -r joydev
-
Check that the module is no longer loaded.
lsmod | grep joydev
Add the Module to the Deny List
Prevent kernel modules from loading at boot by creating a configuration entry in /etc/modprobe.d
.
sudo tee /etc/modprobe.d/joydev-deny.conf <<'EOF'
#DENY joydev
blacklist joydev
install joydev /bin/false
EOF
The blacklist
line prevents the kernel module from loading independently. However, another module may have it as a dependency and could trigger it to load. To avoid any possibility of enabling the module, you can set the install command for the module to run /bin/false
.
Rebuild the Ramdisk Image to Exclude the Module
If you wish to exclude the module from the ramdisk image so it is unavailable to the kernel at boot time, you must rebuild the initramfs
using the dracut command. Since this action can result in a system that is unable to boot, it is good practice to back up the initramfs
beforehand.
-
Check whether the ramdisk image contains the module you want to prevent.
sudo lsinitrd /boot/initramfs-$(uname -r).img|grep joydev.ko
-
Back up the ramdisk image by copying the
initramfs
file for the currently running kernel.sudo cp /boot/initramfs-$(uname -r).img /boot/initramfs-$(uname -r).img.$(date +%m-%d-%H%M%S).bak
-
Rebuild the ramdisk image and specify which modules to omit.
sudo dracut --omit-drivers joydev -f
-
Configure dracut so that the module is excluded in the future when installing other kernels and rebuilding the ramdisk image.
echo "omit_dracutmodules+=\" joydev \"" | sudo tee -a /etc/dracut.conf.d/omit-joydev.conf
Verify the Module is Unloaded
After a system reboot, the kernel will not enable the excluded module during the boot process.
-
Reboot the system to test your changes.
sudo reboot
-
Re-establish your SSH connection to the instance.
If you do not initially connect successfully, retry, as the system may still be in the process of starting up and bringing all of its services online.
-
Check that the joydev module is no longer loaded.
lsmod | grep joydev
(Optional) Configure Kdump to Exclude the Kernel Module
If you configure the system to use Kdump to boot into a crash kernel, you can optionally configure the crash kernel used by Kdump to exclude the kernel module at boot. The decision to exclude the module might depend on why you deactivated it in the regular system kernel. If you want the crash kernel to behave similarly to the system kernel, you should configure Kdump to remove the module.
-
Create a backup of the Kdump ramdisk image for the currently running kernel.
sudo cp /boot/initramfs-$(uname -r)kdump.img /boot/initramfs-$(uname -r)kdump.img.$(date +%m-%d-%H%M%S).bak
-
Edit
/etc/sysconfig/kdump
to configure the KDUMP_COMMANDLINE_APPEND line to set the root device driver blacklist for the module that you want to exclude.sudo sed -i '/^KDUMP_COMMANDLINE_APPEND=/s/"$/ rd.driver.blacklist=joydev"/' /etc/sysconfig/kdump
-
Restart kdump.
sudo kdumpctl restart
-
Rebuild the kdump ramdisk image.
sudo mkdumprd -f /boot/initramfs-$(uname -r)kdump.img
Changes take effect after the next system reboot.
Next Steps
This tutorial explained how to disable a kernel module and prevent it from loading at boot time in Oracle Linux. See the Related Links section for more details and training for Oracle Linux.
Related Links
More Learning Resources
Explore other labs on docs.oracle.com/learn or access more free learning content on the Oracle Learning YouTube channel. Additionally, visit education.oracle.com/learning-explorer to become an Oracle Learning Explorer.
For product documentation, visit Oracle Help Center.
Disable a Kernel Module on Oracle Linux
F81093-02
August 2024