# Ensure dccp kernel module is not available

Necessity: The Datagram Congestion Control Protocol (DCCP) is a transport layer protocol designed for applications that require congestion control for unreliable datagrams. Since it is not commonly used on most systems, disabling it reduces the kernel's attack surface. An unnecessary or unused kernel module could contain vulnerabilities that, if exploited, might lead to local privilege escalation or a denial-of-service attack. The principle of least functionality dictates that any component not explicitly required should be disabled to enhance system security. Auditing and Remediation: The audit script verifies the system's configuration by checking if the 'dccp' module is blacklisted in modprobe configurations and confirms it is not currently loaded into the kernel via 'lsmod'. The remediation script automates the process of disabling the module by creating a modprobe configuration file (e.g., '/etc/modprobe.d/dccp.conf') with 'install dccp /bin/true' to prevent it from loading, and then unloads the module if it's active. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'disabled'. There is no intermediate state for a kernel module; it is either available for use or it is not. For any system that does not have a specific, documented requirement for the DCCP protocol, the module should be disabled to minimize security risks. This approach aligns with hardening standards like the CIS Benchmarks, which universally recommend disabling unused kernel modules to create a more secure and minimalist system kernel.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

bash script that checks the status of the 'dccp' kernel module. The script must output 'disabled' if the module is both configured not to be loaded (via modprobe configuration) and is not currently loaded. It must output 'loaded' if the module is currently active in the kernel. Otherwise, it must output 'enabled'. The script must only return one of these exact strings.

## Remediation Script Working

bash script that accepts a single positional argument, which is the desired state ('disabled'). If the argument is 'disabled', the script must create a configuration file in '/etc/modprobe.d/' to prevent the 'dccp' module from loading and also attempt to unload the module from the running kernel if it is currently loaded. The script must output 'true' on success and 'false' on failure.

