How do I prevent a kernel module from loading automatically?

环境

• Red Hat Enterprise Linux 4, 5, 6, 7, 8

问题

• How do I prevent a kernel module from loading automatically?
• How to disable a kernel module?
• How to disable a specific device driver?

决议

• In order to prevent kernel modules loading during boot, the module name must be added to a configuration file for the "modprobe" utility. This file must reside in /etc/modprobe.d .
• Ensure the module is not configured to get loaded in either /etc/modprobe.conf, /etc/modprobe.d/*, /etc/rc.modules, or /etc/sysconfig/modules/* before making the following modifications.
• Due to differences between the various versions of RHEL, be sure to follow the appropriate steps for your system's version below:
  • The shared steps for RHEL 5, 6, 7, 8 followed by the specific steps for each version
  • The steps for RHEL 4

Shared Initial Steps for Red Hat Enterprise Linux 5, 6, 7 and 8

Kernel modules can be loaded directly, loaded as a dependency from another module, or during the boot process -- because of this, we need to take several measures to keep the module from being loaded.

• [ step1 ] First we unload the module from the running system if it is loaded.

  Raw

  # modprobe -r module_name                                                      #step1
  

• [ step2 ] To prevent a module from being loaded directly you add the blacklist line to a configuration file specific to the system configuration -- for example /etc/modprobe.d/local-dontload.conf.

  This alone will not prevent a module being loaded if it is a required or an optional dependency of another module. Some kernel modules will attempt to load optional modules on demand, which we mitigate in the step3.

  Raw

  # echo "blacklist module_name" >> /etc/modprobe.d/local-dontload.conf            #step2
  

• [ step3 ] The install line simply causes /bin/false to be run instead of installing a module. (The same can be achieved by using /bin/true.)

  The next time the loading of the module is attempted, the /bin/false will be executed instead. This will prevent the module from being loaded on-demand. If the excluded module is required for other specific hardware, there might be unexpected side effects.

  Raw

  # echo "install module_name /bin/false" >> /etc/modprobe.d/local-dontload.conf   #step3
  

• Now continue with the relevant steps for your system's version of RHEL:

  • Finishing Steps for RHEL 8
  • Finishing Steps for RHEL 7
  • Finishing Steps for RHEL 6
  • Finishing Steps for RHEL 5

---

Finishing Steps for Red Hat Enterprise Linux 8 only.

• [ step4 ] Make a backup copy of your initramfs.

  Raw

  # cp /boot/initramfs-$(uname -r).img /boot/initramfs-$(uname -r).img.$(date +%m-%d-%H%M%S).bak
  

• [ step5 ] If the kernel module is part of the initramfs (boot configuration), rebuild your initial ramdisk image, omitting the module to be avoided (see How to rebuild the initial ramdisk image in Red Hat Enterprise Linux for more information).

  Raw

  # dracut --omit-drivers module_name -f
  

• [ step6 ] Get the current kernel command line parameters.

  Raw

  # grub2-editenv - list | grep kernelopts
  

• [ step7 ] Append module_name.blacklist=1 rd.driver.blacklist=module_name at the end of the output found in #step 6. (For RHEl 8, grub2-editenv utility is actually the recommended method for altering these variables. Refer How to manually modify the boot parameter in grub before the system boots for more information).

  Raw

  # grub2-editenv - set kernelopts="<> module_name.blacklist=1 rd.driver.blacklist=module_name"
  
  For example: 
  # grub2-editenv - set kernelopts="root=/dev/mapper/rhel_example-root ro crashkernel=auto resume=/dev/mapper/rhel_example-swap rd.lvm.lv=rhel_example/root rd.lvm.lv=rhel_example/swap module_name.blacklist=1 rd.driver.blacklist=module_name"
  

• [ step8 ] Make a backup copy of the kdump initramfs.

  Raw

  # cp /boot/initramfs-$(uname -r)kdump.img /boot/initramfs-$(uname -r)kdump.img.$(date +%m-%d-%H%M%S).bak
  

• [ step9 ] Append rd.driver.blacklist=module_name to the KDUMP_COMMANDLINE_APPEND setting in /etc/sysconfig/kdump. This will cause it to be omitted from the kdump initramfs.

  Raw

  # sed -i '/^KDUMP_COMMANDLINE_APPEND=/s/"$/ rd.driver.blacklist=module_name"/' /etc/sysconfig/kdump
  

• [ step10 ] Restart the kdump service to pick up the changes to kdump's initrd.

  Raw

  # kdumpctl restart
  

• [ step11 ] Rebuild the kdump initial ramdisk image.

  Raw

  # mkdumprd -f /boot/initramfs-$(uname -r)kdump.img
  

• [ step12 ] Reboot the system at a convenient time to have the changes take effect.

  Raw

  # reboot
  

---

Finishing Steps for Red Hat Enterprise Linux 7 only

• [ step4 ] Make a backup copy of your initramfs.

  Raw

  # cp /boot/initramfs-$(uname -r).img /boot/initramfs-$(uname -r).img.$(date +%m-%d-%H%M%S).bak
  

• [ step5 ] If the kernel module is part of the initramfs (boot configuration), rebuild your initial ramdisk image, omitting the module to be avoided (see How to rebuild the initial ramdisk image in Red Hat Enterprise Linux for more information).

  Raw

  # dracut --omit-drivers module_name -f
  

• [ step6 ] Append module_name.blacklist to the kernel cmdline. We give it an invalid parameter of blacklist and set it to 1 as a way to preclude the kernel from loading it. Here we also set rd.driver.blacklist as another method of preventing it from being loaded.

  Raw

  # sed -i '/^GRUB_CMDLINE_LINUX=/s/"$/ module_name.blacklist=1 rd.driver.blacklist=module_name"/' /etc/default/grub
  

• [ step7 ] Reinstall grub2 to put the kernel cmdline changes into effect. If your system uses UEFI, the path must be changed to /boot/efi/EFI/redhat/grub.cfg

  Raw

  # grub2-mkconfig -o /boot/grub2/grub.cfg
  

• [ step8 ] Make a backup copy of the kdump initramfs.

  Raw

  # cp /boot/initramfs-$(uname -r)kdump.img /boot/initramfs-$(uname -r)kdump.img.$(date +%m-%d-%H%M%S).bak
  

• [ step9 ] Append rd.driver.blacklist=module_name to the KDUMP_COMMANDLINE_APPEND setting in /etc/sysconfig/kdump. This will cause it to be omitted from the kdump initramfs.

  Raw

  # sed -i '/^KDUMP_COMMANDLINE_APPEND=/s/"$/ rd.driver.blacklist=module_name"/' /etc/sysconfig/kdump
  

• [ step10 ] Restart the kdump service to pick up the changes to kdump's initrd.

  Raw

  # kdumpctl restart
  

• [ step11 ] Rebuild the kdump initial ramdisk image.

  Raw

  # mkdumprd -f /boot/initramfs-$(uname -r)kdump.img
  

• [ step12 ] Reboot the system at a convenient time to have the changes take effect.

  Raw

  # reboot
  

---

Finishing Steps for Red Hat Enterprise Linux 6 only

• [ step4 ] Make a backup copy of your initramfs.

  Raw

  # cp /boot/initramfs-$(uname -r).img /boot/initramfs-$(uname -r).img.$(date +%m-%d-%H%M%S).bak
  

• [ step5 ] If the kernel module is part of the initramfs (boot configuration), rebuild your initial ramdisk image, omitting the module to be avoided (see How to rebuild the initial ramdisk image in Red Hat Enterprise Linux for more information).

  Raw

  # dracut --omit-drivers module_name -f
  

• [ step6 ] Append module_name.blacklist to the kernel cmdline. We give it an invalid parameter of blacklist and set it to 1 as a way to preclude the kernel from loading it.

  Raw

  # sed -i '/s*kernel /vmlinuz/s/$/ module_name.blacklist=1/' /boot/grub/grub.conf
  

• [ step7 ] Edit kdump's configuration file: mark it there as excluded from being loaded by kdump.

  Raw

  # echo "blacklist module_name" >> /etc/kdump.conf
  

• [ step8 ] Restart the kdump service to pick up the changes to kdump's initrd.

  Raw

  # service kdump restart
  

• [ step9 ] Reboot the system at a convenient time to have the changes take effect.

  Raw

  # reboot
  

---

Continued Steps for Red Hat Enterprise Linux 5 only

• [ step4 ] Make a backup copy of your initrd.

  Raw

  # cp /boot/initrd-$(uname -r).img /boot/initrd-$(uname -r).img.$(date +%m-%d-%H%M%S).bak
  

• [ step5 ] If the kernel module is part of the initrd (boot configuration), rebuild your initial ramdisk image. Use the --builtin=module_name flag to mkinitrd to have it skip the module in question.

  Raw

  # mkinitrd -v --builtin=module_name
  

• [ step6 ] Append module_name.blacklist to the kernel cmdline. We give it an invalid parameter of blacklist and set it to 1 as a way to preclude the kernel from loading it.

  Raw

  # sed -i '/s*kernel /vmlinuz/s/$/ module_name.blacklist=1/' /boot/grub/grub.conf
  

• [ step7 ] Reboot the system at a convenient time to have the changes take effect.

  Raw

  # reboot
  

Kernel modules can be loaded directly, loaded as a dependency from another module, or during the boot process -- because of this, we need to take several measures to keep the module from being loaded.

---

Red Hat Enterprise Linux 4

• Add the following line to /etc/modprobe.conf:

  Raw

  alias <module name> off
  

• If the kernel module is part of the initrd (boot configuration), the initrd should be regenerated. Boot the affected kernel and run the following command to regenerate the affected kernel initrd.

  Raw

  # mkinitrd /boot/initrd-$(uname -r).img $(uname -r)
  

Remove Module Temporarily

• It is possible to remove any currently-loaded module by running:

  Raw

  # modprobe -r <module name>
  

If the module can not be unloaded. A process or another module may still be using the module, terminate the process and unload the module using the module that is being removed.

Loading Modules

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.