---
title: "HOST-BOOT-005 Kernel Module Loading Unrestricted"
canonical: https://openvapt.com/checks/HOST-BOOT-005.html
html: https://openvapt.com/checks/HOST-BOOT-005.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-BOOT-005 Kernel Module Loading Unrestricted

Checks that the running kernel refuses unsigned modules or has module loading switched off entirely.

- Domain: Server
- Severity: Low
- Control category: Secure Configuration
- Fix effort: medium
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L`
- CIS Controls v8: 4.8
- NIST CSF 2.0: PR.PS-01, PR.IR-01
- CWE: CWE-1188
- NIST SP 800-53 Rev. 5: SI-7, CM-7
- Benchmark topic: Restrict kernel module loading (CIS Controls v8 4.8) (topic only, no benchmark text)

## Why It Matters

A root-level attacker who can load any module owns the kernel: rootkits hide processes and files from every tool on the box. Signature enforcement or kernel.modules_disabled = 1 after boot makes that persistence step fail.

## How It Detects

Reads /proc/sys/kernel/modules_disabled (1 passes), otherwise /sys/module/module/parameters/sig_enforce (Y passes) and /sys/kernel/security/lockdown ([integrity] or [confidentiality] passes). Kernels built without loadable module support are skipped; a value that exists but cannot be read is incomplete.

## How to Fix

Boot with  module.sig_enforce=1  (or  lockdown=integrity) on the kernel command line and sign any out-of-tree modules, or set  kernel.modules_disabled = 1  from a late boot service once every needed module is loaded (it cannot be turned back on without a reboot).

## How to Verify

```
sysctl kernel.modules_disabled; cat /sys/module/module/parameters/sig_enforce /sys/kernel/security/lockdown
```

## Learn the Theory

- [P17 Kernel, Filesystem and Boot Hardening](https://openvapt.com/academy/p17.md)

## References

- [Linux kernel documentation, Kernel module signing facility](https://docs.kernel.org/admin-guide/module-signing.html)
- [Kernel Self Protection Project, Recommended Settings](https://kspp.github.io/Recommended_Settings)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/boot.go

Run it: `openvapt scan --only HOST-BOOT-005`. Read it offline: `openvapt explain HOST-BOOT-005`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-BOOT-005.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.