Do not load specific Linux kernel modules

Vieri Di Paola <[email protected]>
Newsgroups gmane.comp.security.shorewall
Message-ID <CABLYT9gLURN4J+eZ=wqXRpKKBOG_j3byGr_v0DbF60RixFwapg@mail.gmail.com>
Hi,

I'm trying to solve some possible SIP issues in my LAN, and I'd like
to temporarily disable SIP-related Linux kernel modules.
It seems that shorewall loads the modules according to the content of
/usr/share/shorewall/helpers. Instead of touching that file I'd rather
set DONT_LOAD in shorewall.conf.

# grep DONT_LOAD shorewall.conf
DONT_LOAD=nf_nat_sip,nf_conntrack_sip

However, a shorewall restart will not remove the following:

# lsmod | grep -i sip
nf_conntrack_sip       40960  2
nf_conntrack          176128  25
xt_conntrack,nf_nat_irc,nf_nat,nf_conntrack_tftp,nf_nat_ftp,nf_conntrack_pptp,nf_conntrack_netbios_ns,nf_conntrack_sane,xt_nat,nf_nat_tftp,nf_nat_amanda,nf_conntrack_sip,nf_conntrack_h323,nf_nat_pptp,nf_conntrack_broadcast,nf_conntrack_irc,nf_conntrack_amanda,nf_conntrack_netlink,xt_connmark,nf_conntrack_ftp,xt_CT,nf_nat_h323,nf_conntrack_snmp,nf_nat_snmp_basic,xt_REDIRECT

# modprobe -r nf_conntrack_sip
modprobe: FATAL: Module nf_conntrack_sip is in use.

Is there a way to unload nf_conntrack_sip without rebooting the OS?

Regards,

Vieri
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.