Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-26 06:29:25 -05:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #148 from monsieuremre/module-loading-hardening

Browse Source 
Harden the loading of new modules to the kernel after install
This commit is contained in:
Patrick Schleizer 2023-11-05 17:41:56 -05:00 committed by GitHub
commit 36f3c30440
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
lib/systemd/system/harden-module-loading.service Normal file
View File

@ -0,0 +1,14 @@
[Unit]
Description=Disable the loading of modules to the kernel after startup. This could be malicious.
After=systemd-modules-load.service
Before=sysinit.target
# This functionality is implemented with this and not directly in the sysctl config is
# to allow systemd-modules-load.service to load the modules with no problem but
# to disallow anyone else do the same after the system boots up.
[Service]
Type=oneshot
ExecStart=/usr/libexec/security-misc/disable-kernel-module-loading
[Install]
WantedBy=sysinit.target

5
usr/libexec/security-misc/disable-kernel-module-loading Normal file
View File

@ -0,0 +1,5 @@
#!/bin/bash
sysctl -w kernel.modules_disabled=1
echo "The loading of new modules to the kernel has been disabled by security-misc"