# Ensure dccp kernel module is not available

The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol designed for applications that require congestion control for unreliable datagrams but do not need features like in-order delivery. Disabling unused kernel modules like 'dccp' is a critical security best practice. It reduces the kernel's attack surface by removing code that could potentially contain vulnerabilities. An attacker could exploit a flaw in an unused but loadable module to escalate privileges or cause a denial of service. The audit script verifies if the module is explicitly prevented from loading by checking the system's modprobe configuration. The remediation script enforces this security measure by creating a configuration file that instructs the kernel to ignore any requests to load the 'dccp' module. The recommended state for Basic, Moderate, and Strict levels is 'disabled' because the security benefit is binary; the module is either a potential risk or it is not. Any effective hardening strategy requires disabling all unnecessary kernel components to minimize exposure.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'dccp' kernel module is disabled. The script must inspect the system's modprobe configuration for the 'dccp' module. If the configuration output includes 'install /bin/true', indicating it is disabled, the script must return the string 'disabled'. In all other cases, it must return 'enabled'. The output must contain only the resulting string.

## Remediation Script Working

Bash script that accepts one positional command-line argument, which must be 'disabled'. Upon receiving this argument, the script must create a modprobe configuration file (e.g., in /etc/modprobe.d/) with the content 'install dccp /bin/true'. If the module is currently loaded, the script must also attempt to unload it using 'rmmod dccp'. The script must return 'true' on successful application of the configuration and 'false' on failure.

