Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-10-01 08:25:45 -04:00
Code Issues Packages Projects Releases Wiki Activity

Updated comments

Browse Source
This commit is contained in:
Raja Grewal 2022-07-12 16:58:16 +10:00
parent ef1ef9917d
commit 40ec791774
No known key found for this signature in database
GPG Key ID: E34A5801947020A5
1 changed files with 36 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

75
etc/modprobe.d/30_security-misc.conf
View File

@ -1,20 +1,20 @@
## Copyright (C) 2012 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org> ## Copyright (C) 2012 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
# See the following links for a community discussion and overview regarding the selections ## See the following links for a community discussion and overview regarding the selections
# https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989 ## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989
# https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules ## https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules
# Disable automatic conntrack helper assignment ## Disable automatic conntrack helper assignment
# https://phabricator.whonix.org/T486 ## https://phabricator.whonix.org/T486
options nf_conntrack nf_conntrack_helper=0 options nf_conntrack nf_conntrack_helper=0
# Disable bluetooth to reduce attack surface due to extended history of security vulnerabilities ## Disable bluetooth to reduce attack surface due to extended history of security vulnerabilities
# https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns ## https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns
install bluetooth /bin/disabled-by-security-misc install bluetooth /bin/disabled-by-security-misc
install btusb /bin/disabled-by-security-misc install btusb /bin/disabled-by-security-misc
# Disable thunderbolt and firewire modules to prevent some DMA attacks ## Disable thunderbolt and firewire modules to prevent some DMA attacks
install thunderbolt /bin/disabled-by-security-misc install thunderbolt /bin/disabled-by-security-misc
install firewire-core /bin/disabled-by-security-misc install firewire-core /bin/disabled-by-security-misc
install firewire_core /bin/disabled-by-security-misc install firewire_core /bin/disabled-by-security-misc
@ -28,17 +28,14 @@ install dv1394 /bin/disabled-by-security-misc
install raw1394 /bin/disabled-by-security-misc install raw1394 /bin/disabled-by-security-misc
install video1394 /bin/disabled-by-security-misc install video1394 /bin/disabled-by-security-misc
# Disable CPU MSRs as they can be abused to write to arbitrary memory. ## Disable CPU MSRs as they can be abused to write to arbitrary memory.
## https://security.stackexchange.com/questions/119712/methods-root-can-use-to-elevate-itself-to-kernel-mode
install msr /bin/disabled-by-security-misc install msr /bin/disabled-by-security-misc
# Disables unneeded network protocols that will likely not be used as these may have unknown vulnerabilties. ## Disables unneeded network protocols that will likely not be used as these may have unknown vulnerabilties.
# ## Credit to Tails (https://tails.boum.org/blueprint/blacklist_modules/) for some of these.
# Credit to Tails (https://tails.boum.org/blueprint/blacklist_modules/) for some of these. ## > Debian ships a long list of modules for wide support of devices, filesystems, protocols. Some of these modules have a pretty bad security track record, and some of those are simply not used by most of our users.
# ## > Other distributions like Ubuntu[1] and Fedora[2] already ship a blacklist for various network protocols which aren't much in use by users and have a poor security track record.
# > Debian ships a long list of modules for wide support of devices, filesystems, protocols. Some of these modules have a pretty bad security track record, and some of those are simply not used by most of our users.
#
# > Other distributions like Ubuntu[1] and Fedora[2] already ship a blacklist for various network protocols which aren't much in use by users and have a poor security track record.
#
install dccp /bin/disabled-by-security-misc install dccp /bin/disabled-by-security-misc
install sctp /bin/disabled-by-security-misc install sctp /bin/disabled-by-security-misc
install rds /bin/disabled-by-security-misc install rds /bin/disabled-by-security-misc
@ -59,7 +56,7 @@ install p8022 /bin/disabled-by-security-misc
install can /bin/disabled-by-security-misc install can /bin/disabled-by-security-misc
install atm /bin/disabled-by-security-misc install atm /bin/disabled-by-security-misc
# Disable uncommon file systems to reduce attack surface ## Disable uncommon file systems to reduce attack surface
install cramfs /bin/disabled-by-security-misc install cramfs /bin/disabled-by-security-misc
install freevxfs /bin/disabled-by-security-misc install freevxfs /bin/disabled-by-security-misc
install jffs2 /bin/disabled-by-security-misc install jffs2 /bin/disabled-by-security-misc
@ -67,7 +64,7 @@ install hfs /bin/disabled-by-security-misc
install hfsplus /bin/disabled-by-security-misc install hfsplus /bin/disabled-by-security-misc
install udf /bin/disabled-by-security-misc install udf /bin/disabled-by-security-misc
# Disable uncommon network file systems to reduce attack surface ## Disable uncommon network file systems to reduce attack surface
install cifs /bin/disabled-by-security-misc install cifs /bin/disabled-by-security-misc
install nfs /bin/disabled-by-security-misc install nfs /bin/disabled-by-security-misc
install nfsv3 /bin/disabled-by-security-misc install nfsv3 /bin/disabled-by-security-misc
@ -75,23 +72,23 @@ install nfsv4 /bin/disabled-by-security-misc
install ksmbd /bin/disabled-by-security-misc install ksmbd /bin/disabled-by-security-misc
install gfs2 /bin/disabled-by-security-misc install gfs2 /bin/disabled-by-security-misc
# Disables the vivid kernel module as it's only required for testing and has been the cause of multiple vulnerabilities ## Disables the vivid kernel module as it's only required for testing and has been the cause of multiple vulnerabilities
# https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233 ## https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233
# https://www.openwall.com/lists/oss-security/2019/11/02/1 ## https://www.openwall.com/lists/oss-security/2019/11/02/1
# https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475 ## https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475
install vivid /bin/disabled-by-security-misc install vivid /bin/disabled-by-security-misc
# Disable Intel Management Engine (ME) interface with the OS ## Disable Intel Management Engine (ME) interface with the OS
# https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html ## https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html
install mei /bin/disabled-by-security-misc install mei /bin/disabled-by-security-misc
install mei-me /bin/disabled-by-security-misc install mei-me /bin/disabled-by-security-misc
# Blacklist automatic loading of the Atheros 5K RF MACs madwifi driver ## Blacklist automatic loading of the Atheros 5K RF MACs madwifi driver
# https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-ath_pci.conf?h=ubuntu/disco ## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-ath_pci.conf?h=ubuntu/disco
blacklist ath_pci blacklist ath_pci
# Blacklist automatic loading of miscellaneous modules ## Blacklist automatic loading of miscellaneous modules
# https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist.conf?h=ubuntu/disco ## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist.conf?h=ubuntu/disco
blacklist evbug blacklist evbug
blacklist usbmouse blacklist usbmouse
blacklist usbkbd blacklist usbkbd
@ -108,23 +105,23 @@ blacklist snd_pcsp
blacklist pcspkr blacklist pcspkr
blacklist amd76x_edac blacklist amd76x_edac
# Blacklist automatic loading of framebuffer drivers ## Blacklist automatic loading of framebuffer drivers
# https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-framebuffer.conf?h=ubuntu/disco ## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-framebuffer.conf?h=ubuntu/disco
blacklist aty128fb blacklist aty128fb
blacklist atyfb blacklist atyfb
# blacklist radeonfb #blacklist radeonfb
blacklist cirrusfb blacklist cirrusfb
blacklist cyber2000fb blacklist cyber2000fb
blacklist cyblafb blacklist cyblafb
blacklist gx1fb blacklist gx1fb
blacklist hgafb blacklist hgafb
blacklist i810fb blacklist i810fb
# blacklist intelfb #blacklist intelfb
blacklist kyrofb blacklist kyrofb
blacklist lxfb blacklist lxfb
blacklist matroxfb_base blacklist matroxfb_bases
blacklist neofb blacklist neofb
# blacklist nvidiafb #blacklist nvidiafb
blacklist pm2fb blacklist pm2fb
blacklist rivafb blacklist rivafb
blacklist s1d13xxxfb blacklist s1d13xxxfb
@ -133,15 +130,15 @@ blacklist sisfb
blacklist sstfb blacklist sstfb
blacklist tdfxfb blacklist tdfxfb
blacklist tridentfb blacklist tridentfb
# blacklist vesafb #blacklist vesafb
blacklist vfb blacklist vfb
blacklist viafb blacklist viafb
blacklist vt8623fb blacklist vt8623fb
blacklist udlfb blacklist udlfb
# Disable CD-ROM devices ## Disable CD-ROM devices
# https://nvd.nist.gov/vuln/detail/CVE-2018-11506 ## https://nvd.nist.gov/vuln/detail/CVE-2018-11506
# https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31 ## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31
#install cdrom /bin/disabled-by-security-misc #install cdrom /bin/disabled-by-security-misc
#install sr_mod /bin/disabled-by-security-misc #install sr_mod /bin/disabled-by-security-misc
blacklist cdrom blacklist cdrom