NAME

Monitoring::Sneck::Checks::kernel_modules - checks kernel modules are or are not loaded

VERSION

Version 0.0.1

SYNOPSIS

!no_cramfs|control=CIS-1.1.1.1 framework=CIS|perl:kernel_modules -n cramfs
!no_usb_storage||perl:kernel_modules -a usb_storage -a firewire_core
zfs_loaded|perl:kernel_modules -p zfs

DESCRIPTION

Checks modules are loaded, or are not, as given. Anything not as given is CRITICAL. - and _ are the same in names, as the kernel takes them.

--not-loadable goes further than --absent, as CIS wants. The module must not be loaded, and must also have a "install name /bin/false" or "/bin/true" line in modprobe.d, so modprobe can not load it either.

On Linux, loaded modules are read from /proc/modules. Built in ones, from modules.builtin, count as loaded for --present and fail --absent and --not-loadable, as they can not be kept out. On FreeBSD, kldstat -q -m is asked about each, and --not-loadable is not supported. Other OSes are UNKNOWN.

OPTIONS

- -p, --present :: A module that must be loaded. May be given more than once.

- -a, --absent :: A module that must not be loaded. May be given more than once.

- -n, --not-loadable :: A module that must not be loaded or loadable. May be given more than once.

One or more of --present, --absent, or --not-loadable must be given.

METHODS

check

Does the check.

builtin

Returns a hash ref of the modules built into the running Linux kernel, from modules.builtin, empty if it is not there.

blocked

Returns a hash ref of the modules modprobe.d has a "install name /bin/false" or "/bin/true" line for.