In Ubuntu Server, systemd-modules-load.service is an early-boot systemd component responsible for aggressively loading static kernel modules (drivers) defined within /etc/modules-load.d/ and other configuration directories. During the initialization phase, this service reads the configuration files and forcefully injects the specified modules into the running kernel. While useful in generic environments where specific legacy hardware drivers must be loaded regardless of dynamic hardware detection, it represents a significant security and stability risk in highly secured, immutable infrastructure. In sterile virtualized environments or hardened containers where the kernel surface must remain absolutely minimal and strictly audited, allowing an automated service to inject arbitrary modules violates zero-trust principles.
This guide explains how to completely disable the systemd-modules-load service in Ubuntu Server, ensuring absolute suppression of automated, static kernel module injection.
Warning: Disabling this service will prevent Ubuntu from automatically loading static modules. If your hardware relies on a driver that is not dynamically loaded by udev, your system may fail to boot or lose network connectivity.
Stop and Mask the systemd-modules-load Service
To guarantee that this service cannot execute and inject code into the kernel ring, we must disable and explicitly mask the unit file.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - First, stop the active service (though it primarily runs only during boot):
sudo systemctl stop systemd-modules-load.service - Next, disable the service to remove it from the systemd boot schedule:
sudo systemctl disable systemd-modules-load.service - For absolute certainty, explicitly mask the service. This symlinks the unit file to
/dev/null, creating a hard block against it starting under any circumstances:sudo systemctl mask systemd-modules-load.service
Verify the Service Lockdown
By masking systemd-modules-load.service, you guarantee that systemd will completely ignore the unit, preventing any automated interactions with the kernel module framework (kmod).
To verify the lockdown is successful, attempt to start the service manually:
sudo systemctl start systemd-modules-load.serviceSystemd will return a fatal error stating that the unit is masked (e.g., Failed to start systemd-modules-load.service: Unit systemd-modules-load.service is masked). You have successfully neutralized the static module loader, hardening your server’s kernel perimeter and ensuring that only dynamically detected (via udev) or explicitly compiled-in modules are active.