Block obscure network protocols

Why it matters

Linux can load drivers for old or rare network protocols such as DCCP, SCTP, AX.25 and ATM the moment a program opens a socket of that type, with no administrator involved. Several of these have had serious bugs. For example, in 2017 a flaw in DCCP (CVE-2017-6074) let a local user gain root by making the kernel load that module.

How it works

Adds a modprobe configuration that makes loading each module in the net-protocols group fail. Because the kernel asks modprobe when an unknown protocol is requested, an ordinary program can no longer trigger the load.

Who should use it

Nearly every desktop and server. Leave it off if you use SCTP (some telecom and WebRTC software), CAN bus, amateur radio networking, or similar gear.

What you may notice

Almost never. A program that needs one of these protocols fails to open its socket with an error such as Protocol not supported or Address family not supported.

Check it on your computer

See whether the modules are loaded:

lsmod | grep -E '^(dccp|sctp|rds|tipc|n-hdlc|ax25|netrom|x25|rose|decnet|econet|af_802154|ipx|appletalk|psnap|p8023|p8022|can|atm) '

Apply it by hand

Tell the system not to load them, in a file you own:

sudo tee /etc/modprobe.d/90-modules-net-protocols.conf <<'EOF'
install dccp /bin/false
install sctp /bin/false
install rds /bin/false
install tipc /bin/false
install n-hdlc /bin/false
install ax25 /bin/false
install netrom /bin/false
install x25 /bin/false
install rose /bin/false
install decnet /bin/false
install econet /bin/false
install af_802154 /bin/false
install ipx /bin/false
install appletalk /bin/false
install psnap /bin/false
install p8023 /bin/false
install p8022 /bin/false
install can /bin/false
install atm /bin/false
EOF

Undo it

Remove the file. Modules already loaded stay until the next restart.

Related settings

• Block rarely used file systems
• Do not load terminal line disciplines on demand

Sources

Linux Hardening Guide (madaidans)

2.5.2