From e0696d02a234e6f7ab9fb601ffe58e7d953846a2 Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Mon, 15 Jul 2024 20:46:04 +1000 Subject: [PATCH 01/14] Update `security-misc.maintscript` Due to previous splitting IN https://github.com/Kicksecure/security-misc/commit/b02230a783941da412be72fb52053db0c6b8010f. --- debian/security-misc.maintscript | 1 + 1 file changed, 1 insertion(+) diff --git a/debian/security-misc.maintscript b/debian/security-misc.maintscript index 5d115c3..59043e5 100644 --- a/debian/security-misc.maintscript +++ b/debian/security-misc.maintscript @@ -31,6 +31,7 @@ rm_conffile /etc/modprobe.d/vivid.conf rm_conffile /etc/modprobe.d/blacklist-dma.conf rm_conffile /etc/modprobe.d/msr.conf rm_conffile /etc/modprobe.d/30_nf_conntrack_helper_disable.conf +rm_conffile /etc/modprobe.d/30_security-misc.conf ## renamed to /etc/security/limits.d/30_security-misc.conf rm_conffile /etc/security/limits.d/disable-coredumps.conf From 4476a477a77c98cf4334fbcb866bc8f113f568ac Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Mon, 15 Jul 2024 20:47:07 +1000 Subject: [PATCH 02/14] Provide option to disable more Bluetooth modules --- etc/modprobe.d/30_security-misc_disable.conf | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/etc/modprobe.d/30_security-misc_disable.conf b/etc/modprobe.d/30_security-misc_disable.conf index f82ccb6..bd6a181 100644 --- a/etc/modprobe.d/30_security-misc_disable.conf +++ b/etc/modprobe.d/30_security-misc_disable.conf @@ -16,7 +16,22 @@ ## Now replaced by a privacy and security preserving default Bluetooth configuration for better usability. ## #install bluetooth /usr/bin/disabled-bluetooth-by-security-misc +#install bluetooth_6lowpan /usr/bin/disabled-bluetooth-by-security-misc +#install bt3c_cs /usr/bin/disabled-bluetooth-by-security-misc +#install btbcm /usr/bin/disabled-bluetooth-by-security-misc +#install btintel /usr/bin/disabled-bluetooth-by-security-misc +#install btmrvl /usr/bin/disabled-bluetooth-by-security-misc +#install btmrvl_sdio /usr/bin/disabled-bluetooth-by-security-misc +#install btmtk /usr/bin/disabled-bluetooth-by-security-misc +#install btmtksdio /usr/bin/disabled-bluetooth-by-security-misc +#install btmtkuart /usr/bin/disabled-bluetooth-by-security-misc +#install btnxpuart /usr/bin/disabled-bluetooth-by-security-misc +#install btqca /usr/bin/disabled-bluetooth-by-security-misc +#install btrsi /usr/bin/disabled-bluetooth-by-security-misc +#install btrtl /usr/bin/disabled-bluetooth-by-security-misc +#install btsdio /usr/bin/disabled-bluetooth-by-security-misc #install btusb /usr/bin/disabled-bluetooth-by-security-misc +#install virtio_bt /usr/bin/disabled-bluetooth-by-security-misc ## CPU Model-Specific Registers (MSRs): ## Disable CPU MSRs as they can be abused to write to arbitrary memory. From 99b0ce7948213e7f7adf42ddd7c7beb229374bd4 Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Mon, 15 Jul 2024 20:47:56 +1000 Subject: [PATCH 03/14] Disable more file systems --- etc/modprobe.d/30_security-misc_disable.conf | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/etc/modprobe.d/30_security-misc_disable.conf b/etc/modprobe.d/30_security-misc_disable.conf index bd6a181..e36f074 100644 --- a/etc/modprobe.d/30_security-misc_disable.conf +++ b/etc/modprobe.d/30_security-misc_disable.conf @@ -43,13 +43,15 @@ ## File Systems: ## Disable uncommon file systems to reduce attack surface. -## HFS and HFS+ are legacy Apple filesystems that may be required depending on the EFI partition format. +## HFS and HFS+ are legacy Apple file systems that may be required depending on the EFI partition format. ## install cramfs /usr/bin/disabled-filesys-by-security-misc install freevxfs /usr/bin/disabled-filesys-by-security-misc install hfs /usr/bin/disabled-filesys-by-security-misc install hfsplus /usr/bin/disabled-filesys-by-security-misc install jffs2 /usr/bin/disabled-filesys-by-security-misc +install jfs /usr/bin/disabled-filesys-by-security-misc +install reiserfs /usr/bin/disabled-filesys-by-security-misc install udf /usr/bin/disabled-filesys-by-security-misc ## FireWire (IEEE 1394): From 82c5a93f7cf2846490120c5262a146a313a5ce47 Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Mon, 15 Jul 2024 20:53:07 +1000 Subject: [PATCH 04/14] Disable another GPS module --- README.md | 4 ++-- etc/modprobe.d/30_security-misc_blacklist.conf | 1 - etc/modprobe.d/30_security-misc_disable.conf | 1 + 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index b5cf7a3..442c2be 100644 --- a/README.md +++ b/README.md @@ -150,8 +150,8 @@ disabling should first be blacklisted for a suitable amount of time. - FireWire (IEEE 1394): Disabled as they are often vulnerable to DMA attacks. -- GPS: Disables GPS-related modules responsible systems such as for Global - Navigation Satellite System (GNSS). +- GPS: Disable GPS-related modules such as those required for Global Navigation + Satellite Systems (GNSS). - Intel Management Engine (ME): Provides some disabling of the interface between the Intel ME and the OS. diff --git a/etc/modprobe.d/30_security-misc_blacklist.conf b/etc/modprobe.d/30_security-misc_blacklist.conf index 6dce2d2..c192c3c 100644 --- a/etc/modprobe.d/30_security-misc_blacklist.conf +++ b/etc/modprobe.d/30_security-misc_blacklist.conf @@ -67,7 +67,6 @@ blacklist eepro100 blacklist eth1394 blacklist evbug blacklist de4x5 -blacklist garmin_gps blacklist pcspkr blacklist prism54 blacklist snd_aw2 diff --git a/etc/modprobe.d/30_security-misc_disable.conf b/etc/modprobe.d/30_security-misc_disable.conf index e36f074..40bcf7f 100644 --- a/etc/modprobe.d/30_security-misc_disable.conf +++ b/etc/modprobe.d/30_security-misc_disable.conf @@ -72,6 +72,7 @@ install video1394 /usr/bin/disabled-firewire-by-security-misc ## Global Positioning Systems (GPS): ## Disable GPS-related modules like GNSS (Global Navigation Satellite System). ## +install garmin_gps /usr/bin/disabled-gps-by-security-misc install gnss /usr/bin/disabled-gps-by-security-misc install gnss-mtk /usr/bin/disabled-gps-by-security-misc install gnss-serial /usr/bin/disabled-gps-by-security-misc From 9e40ff055195b1e8637d1e957c3f8db01f99bbc1 Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Mon, 15 Jul 2024 20:54:18 +1000 Subject: [PATCH 05/14] Disable more network file systems --- etc/modprobe.d/30_security-misc_disable.conf | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/etc/modprobe.d/30_security-misc_disable.conf b/etc/modprobe.d/30_security-misc_disable.conf index 40bcf7f..423aced 100644 --- a/etc/modprobe.d/30_security-misc_disable.conf +++ b/etc/modprobe.d/30_security-misc_disable.conf @@ -91,10 +91,23 @@ install mei-me /usr/bin/disabled-intelme-by-security-misc ## Network File Systems: ## Disable uncommon network file systems to reduce attack surface. ## -install cifs /usr/bin/disabled-netfilesys-by-security-misc install gfs2 /usr/bin/disabled-netfilesys-by-security-misc install ksmbd /usr/bin/disabled-netfilesys-by-security-misc +## +## Common Internet File System (CIFS): +## +install cifs /usr/bin/disabled-netfilesys-by-security-misc +install cifs_arc4 /usr/bin/disabled-netfilesys-by-security-misc +install cifs_md4 /usr/bin/disabled-netfilesys-by-security-misc +## +## Network File System (NFS): +## install nfs /usr/bin/disabled-netfilesys-by-security-misc +install nfs_acl /usr/bin/disabled-netfilesys-by-security-misc +install nfs_layout_nfsv41_files /usr/bin/disabled-netfilesys-by-security-misc +install nfs_layout_flexfiles /usr/bin/disabled-netfilesys-by-security-misc +install nfsd /usr/bin/disabled-netfilesys-by-security-misc +install nfsv2 /usr/bin/disabled-netfilesys-by-security-misc install nfsv3 /usr/bin/disabled-netfilesys-by-security-misc install nfsv4 /usr/bin/disabled-netfilesys-by-security-misc From 51f7776bc8722752d53fc503b0c79564d8715d4c Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Mon, 15 Jul 2024 20:56:12 +1000 Subject: [PATCH 06/14] Disable more network protocols/drivers --- .../30_security-misc_blacklist.conf | 2 - etc/modprobe.d/30_security-misc_disable.conf | 57 +++++++++++++++++-- 2 files changed, 51 insertions(+), 8 deletions(-) diff --git a/etc/modprobe.d/30_security-misc_blacklist.conf b/etc/modprobe.d/30_security-misc_blacklist.conf index c192c3c..c35af0b 100644 --- a/etc/modprobe.d/30_security-misc_blacklist.conf +++ b/etc/modprobe.d/30_security-misc_blacklist.conf @@ -63,8 +63,6 @@ blacklist ath_pci blacklist amd76x_edac blacklist asus_acpi blacklist bcm43xx -blacklist eepro100 -blacklist eth1394 blacklist evbug blacklist de4x5 blacklist pcspkr diff --git a/etc/modprobe.d/30_security-misc_disable.conf b/etc/modprobe.d/30_security-misc_disable.conf index 423aced..9ba5f84 100644 --- a/etc/modprobe.d/30_security-misc_disable.conf +++ b/etc/modprobe.d/30_security-misc_disable.conf @@ -115,28 +115,73 @@ install nfsv4 /usr/bin/disabled-netfilesys-by-security-misc ## Disables rare and unneeded network protocols that are a common source of unknown vulnerabilities. ## ## https://tails.boum.org/blueprint/blacklist_modules/ -## https://fedoraproject.org/wiki/Security_Features_Matrix#Blacklist_Rare_Protocols) +## https://fedoraproject.org/wiki/Security_Features_Matrix#Blacklist_Rare_Protocols ## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-rare-network.conf?h=ubuntu/disco ## install af_802154 /usr/bin/disabled-network-by-security-misc install appletalk /usr/bin/disabled-network-by-security-misc -install atm /usr/bin/disabled-network-by-security-misc install ax25 /usr/bin/disabled-network-by-security-misc -install can /usr/bin/disabled-network-by-security-misc +install brcm80211 /bin/true /usr/bin/disabled-network-by-security-misc install decnet /usr/bin/disabled-network-by-security-misc install dccp /usr/bin/disabled-network-by-security-misc install econet /usr/bin/disabled-network-by-security-misc +install eepro100 /usr/bin/disabled-network-by-security-misc +install eth1394 /usr/bin/disabled-network-by-security-misc install ipx /usr/bin/disabled-network-by-security-misc install n-hdlc /usr/bin/disabled-network-by-security-misc install netrom /usr/bin/disabled-network-by-security-misc install p8022 /usr/bin/disabled-network-by-security-misc install p8023 /usr/bin/disabled-network-by-security-misc install psnap /usr/bin/disabled-network-by-security-misc -install rds /usr/bin/disabled-network-by-security-misc install rose /usr/bin/disabled-network-by-security-misc -install sctp /usr/bin/disabled-network-by-security-misc -install tipc /usr/bin/disabled-network-by-security-misc install x25 /usr/bin/disabled-network-by-security-misc +## +## Asynchronous Transfer Mode (ATM): +## +install atm /usr/bin/disabled-network-by-security-misc +install ueagle-atm /usr/bin/disabled-network-by-security-misc +install usbatm /usr/bin/disabled-network-by-security-misc +install xusbatm /usr/bin/disabled-network-by-security-misc +## +## Controller Area Network (CAN) Protocol: +## +install c_can /usr/bin/disabled-network-by-security-misc +install c_can_pci /usr/bin/disabled-network-by-security-misc +install c_can_platform /usr/bin/disabled-network-by-security-misc +install can /usr/bin/disabled-network-by-security-misc +install can-bcm /usr/bin/disabled-network-by-security-misc +install can-dev /usr/bin/disabled-network-by-security-misc +install can-gw /usr/bin/disabled-network-by-security-misc +install can-isotp /usr/bin/disabled-network-by-security-misc +install can-raw /usr/bin/disabled-network-by-security-misc +install can-j1939 /usr/bin/disabled-network-by-security-misc +install can327 /usr/bin/disabled-network-by-security-misc +install ifi_canfd /usr/bin/disabled-network-by-security-misc +install janz-ican3 /usr/bin/disabled-network-by-security-misc +install m_can /usr/bin/disabled-network-by-security-misc +install m_can_pci /usr/bin/disabled-network-by-security-misc +install m_can_platform /usr/bin/disabled-network-by-security-misc +install phy-can-transceiver /usr/bin/disabled-network-by-security-misc +install slcan /usr/bin/disabled-network-by-security-misc +install ucan /usr/bin/disabled-network-by-security-misc +install vxcan /usr/bin/disabled-network-by-security-misc +install vcan /usr/bin/disabled-network-by-security-misc +## +## Transparent Inter Process Communication (TIPC): +## +install tipc /usr/bin/disabled-network-by-security-misc +install tipc_diag /usr/bin/disabled-network-by-security-misc +## +## Reliable Datagram Sockets (RDS): +## +install rds /usr/bin/disabled-network-by-security-misc +install rds_rdma /usr/bin/disabled-network-by-security-misc +install rds_tcp /usr/bin/disabled-network-by-security-misc +## +## Stream Control Transmission Protocol (SCTP): +## +install sctp /usr/bin/disabled-network-by-security-misc +install sctp_diag /usr/bin/disabled-network-by-security-misc ## Miscellaneous: ## From 96aa63267a6fcee03f252f0791f37b7b6222a7c1 Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Mon, 15 Jul 2024 20:57:14 +1000 Subject: [PATCH 07/14] Disable more Thunderbolt modules --- etc/modprobe.d/30_security-misc_disable.conf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/etc/modprobe.d/30_security-misc_disable.conf b/etc/modprobe.d/30_security-misc_disable.conf index 9ba5f84..74ce512 100644 --- a/etc/modprobe.d/30_security-misc_disable.conf +++ b/etc/modprobe.d/30_security-misc_disable.conf @@ -199,4 +199,6 @@ install vivid /usr/bin/disabled-vivid-by-security-misc ## ## https://en.wikipedia.org/wiki/Thunderbolt_(interface)#Security_vulnerabilities ## +install intel-wmi-thunderbolt /usr/bin/disabled-thunderbolt-by-security-misc install thunderbolt /usr/bin/disabled-thunderbolt-by-security-misc +install thunderbolt_net /usr/bin/disabled-thunderbolt-by-security-misc From c52b1a3fd269ef4f98028dd5eead476abe5d138d Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Mon, 15 Jul 2024 20:58:45 +1000 Subject: [PATCH 08/14] Create `disabled-miscellaneous-by-security-misc` --- usr/bin/disabled-miscellaneous-by-security-misc | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100755 usr/bin/disabled-miscellaneous-by-security-misc diff --git a/usr/bin/disabled-miscellaneous-by-security-misc b/usr/bin/disabled-miscellaneous-by-security-misc new file mode 100755 index 0000000..2c23909 --- /dev/null +++ b/usr/bin/disabled-miscellaneous-by-security-misc @@ -0,0 +1,10 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP +## See the file COPYING for copying conditions. + +## Alerts the user that a kernel module failed to load due to it being blacklisted by default. + +echo "$0: ERROR: This kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf | args: $@" >&2 + +exit 1 From cb2fb95b81efa2ebb2bd80aeaacad9122f0f073c Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Mon, 15 Jul 2024 21:01:36 +1000 Subject: [PATCH 09/14] Disable more miscellaneous drivers --- etc/modprobe.d/30_security-misc_disable.conf | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/etc/modprobe.d/30_security-misc_disable.conf b/etc/modprobe.d/30_security-misc_disable.conf index 74ce512..024a0b1 100644 --- a/etc/modprobe.d/30_security-misc_disable.conf +++ b/etc/modprobe.d/30_security-misc_disable.conf @@ -185,6 +185,14 @@ install sctp_diag /usr/bin/disabled-network-by-security-misc ## Miscellaneous: ## +## Amateur Radios: +## +install hamradio /bin/true /usr/bin/disabled-miscellaneous-by-security-misc +## +## Floppy Disks: +## +install floppy /bin/true /usr/bin/disabled-miscellaneous-by-security-misc +## ## Vivid: ## Disables the vivid kernel module since it has been the cause of multiple vulnerabilities. ## From 8219a1e257525d487a49e7b3a6b14c1e180a7b52 Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Mon, 15 Jul 2024 21:02:10 +1000 Subject: [PATCH 10/14] Update README.md relating to disabled miscellaneous modules --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 442c2be..d99cdaa 100644 --- a/README.md +++ b/README.md @@ -160,7 +160,8 @@ disabling should first be blacklisted for a suitable amount of time. - Network Protocols: Wide array of uncommon and legacy network protocols are disabled. -- Miscellaneous: Disable an assortment other modules such as vivid. +- Miscellaneous: Disable an assortment other modules such as those required + for amateur radio, floppy disks, and vivid. - Thunderbolt: Disabled as they are often vulnerable to DMA attacks. From fda3832eaf293915ab77ce73a0be2caec15e21fa Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Mon, 15 Jul 2024 21:08:45 +1000 Subject: [PATCH 11/14] Replace bash file presented for disabling of miscellaneous modules --- debian/security-misc.maintscript | 3 +++ etc/modprobe.d/30_security-misc_disable.conf | 4 ++-- usr/bin/disabled-vivid-by-security-misc | 10 ---------- 3 files changed, 5 insertions(+), 12 deletions(-) delete mode 100755 usr/bin/disabled-vivid-by-security-misc diff --git a/debian/security-misc.maintscript b/debian/security-misc.maintscript index 59043e5..e046582 100644 --- a/debian/security-misc.maintscript +++ b/debian/security-misc.maintscript @@ -67,3 +67,6 @@ rm_conffile /etc/permission-hardening.d/25_default_whitelist_sudo.conf rm_conffile /etc/permission-hardening.d/25_default_whitelist_unix_chkpwd.conf rm_conffile /etc/permission-hardening.d/25_default_whitelist_virtualbox.conf rm_conffile /etc/permission-hardening.d/30_default.conf + +## repalced with /usr/bin/disabled-miscellaneous-by-security-misc +rm_conffile /usr/bin/disabled-vivid-by-security-misc \ No newline at end of file diff --git a/etc/modprobe.d/30_security-misc_disable.conf b/etc/modprobe.d/30_security-misc_disable.conf index 024a0b1..eda012c 100644 --- a/etc/modprobe.d/30_security-misc_disable.conf +++ b/etc/modprobe.d/30_security-misc_disable.conf @@ -39,7 +39,7 @@ ## https://security.stackexchange.com/questions/119712/methods-root-can-use-to-elevate-itself-to-kernel-mode ## https://github.com/Kicksecure/security-misc/issues/215 ## -#install msr /usr/bin/disabled-msr-by-security-misc +#install msr /usr/bin/disabled-miscellaneous-by-security-misc ## File Systems: ## Disable uncommon file systems to reduce attack surface. @@ -200,7 +200,7 @@ install floppy /bin/true /usr/bin/disabled-miscellaneous-by-security-misc ## https://www.openwall.com/lists/oss-security/2019/11/02/1 ## https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475 ## -install vivid /usr/bin/disabled-vivid-by-security-misc +install vivid /usr/bin/disabled-miscellaneous-by-security-misc ## Thunderbolt: ## Disables Thunderbolt modules to prevent some DMA attacks. diff --git a/usr/bin/disabled-vivid-by-security-misc b/usr/bin/disabled-vivid-by-security-misc deleted file mode 100755 index f2d07b7..0000000 --- a/usr/bin/disabled-vivid-by-security-misc +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash - -## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP -## See the file COPYING for copying conditions. - -## Alerts the user that a kernel module failed to load due to it being blacklisted by default. - -echo "$0: ERROR: This vivid kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf | args: $@" >&2 - -exit 1 From a8bc1144c32b4b4f20904af5f813da1051fe4c9c Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Mon, 15 Jul 2024 21:10:13 +1000 Subject: [PATCH 12/14] Updated wording of error files for disabled modules --- usr/bin/disabled-bluetooth-by-security-misc | 2 +- usr/bin/disabled-cdrom-by-security-misc | 2 +- usr/bin/disabled-firewire-by-security-misc | 2 +- usr/bin/disabled-gps-by-security-misc | 2 +- usr/bin/disabled-thunderbolt-by-security-misc | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/usr/bin/disabled-bluetooth-by-security-misc b/usr/bin/disabled-bluetooth-by-security-misc index 7e011e3..3669fc1 100755 --- a/usr/bin/disabled-bluetooth-by-security-misc +++ b/usr/bin/disabled-bluetooth-by-security-misc @@ -5,6 +5,6 @@ ## Alerts the user that a kernel module failed to load due to it being blacklisted by default. -echo "$0: ERROR: This bluetooth kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf | args: $@" >&2 +echo "$0: ERROR: This Bluetooth kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf | args: $@" >&2 exit 1 diff --git a/usr/bin/disabled-cdrom-by-security-misc b/usr/bin/disabled-cdrom-by-security-misc index 55f4b0c..4a7b141 100755 --- a/usr/bin/disabled-cdrom-by-security-misc +++ b/usr/bin/disabled-cdrom-by-security-misc @@ -5,6 +5,6 @@ ## Alerts the user that a kernel module failed to load due to it being blacklisted by default. -echo "$0: ERROR: This CD-ROM kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf | args: $@" >&2 +echo "$0: ERROR: This CD-ROM/DVD kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf | args: $@" >&2 exit 1 diff --git a/usr/bin/disabled-firewire-by-security-misc b/usr/bin/disabled-firewire-by-security-misc index cbde5d1..2abc6bc 100755 --- a/usr/bin/disabled-firewire-by-security-misc +++ b/usr/bin/disabled-firewire-by-security-misc @@ -5,6 +5,6 @@ ## Alerts the user that a kernel module failed to load due to it being blacklisted by default. -echo "$0: ERROR: This firewire kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf | args: $@" >&2 +echo "$0: ERROR: This FireWire (IEEE 1394) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf | args: $@" >&2 exit 1 diff --git a/usr/bin/disabled-gps-by-security-misc b/usr/bin/disabled-gps-by-security-misc index f1a24bf..d43626e 100755 --- a/usr/bin/disabled-gps-by-security-misc +++ b/usr/bin/disabled-gps-by-security-misc @@ -5,6 +5,6 @@ ## Alerts the user that a kernel module failed to load due to it being blacklisted by default. -echo "$0: ERROR: This GNSS (Global Navigation Satellite System) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf | args: $@" >&2 +echo "$0: ERROR: This GPS (Global Positioning System) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf | args: $@" >&2 exit 1 diff --git a/usr/bin/disabled-thunderbolt-by-security-misc b/usr/bin/disabled-thunderbolt-by-security-misc index 98f0840..dbe89ec 100755 --- a/usr/bin/disabled-thunderbolt-by-security-misc +++ b/usr/bin/disabled-thunderbolt-by-security-misc @@ -5,6 +5,6 @@ ## Alerts the user that a kernel module failed to load due to it being blacklisted by default. -echo "$0: ERROR: This thunderbolt kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf | args: $@" >&2 +echo "$0: ERROR: This Thunderbolt kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf | args: $@" >&2 exit 1 From f2db11269e89d4c945642b661aa9cbe356f89037 Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Mon, 15 Jul 2024 21:18:32 +1000 Subject: [PATCH 13/14] Fix script --- etc/modprobe.d/30_security-misc_disable.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/etc/modprobe.d/30_security-misc_disable.conf b/etc/modprobe.d/30_security-misc_disable.conf index eda012c..d6b5122 100644 --- a/etc/modprobe.d/30_security-misc_disable.conf +++ b/etc/modprobe.d/30_security-misc_disable.conf @@ -187,11 +187,11 @@ install sctp_diag /usr/bin/disabled-network-by-security-misc ## ## Amateur Radios: ## -install hamradio /bin/true /usr/bin/disabled-miscellaneous-by-security-misc +install hamradio /usr/bin/disabled-miscellaneous-by-security-misc ## ## Floppy Disks: ## -install floppy /bin/true /usr/bin/disabled-miscellaneous-by-security-misc +install floppy /usr/bin/disabled-miscellaneous-by-security-misc ## ## Vivid: ## Disables the vivid kernel module since it has been the cause of multiple vulnerabilities. From 9300c208e25d936f2c633a0904126566afc1c275 Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Mon, 15 Jul 2024 21:36:25 +1000 Subject: [PATCH 14/14] Fix script --- etc/modprobe.d/30_security-misc_disable.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/etc/modprobe.d/30_security-misc_disable.conf b/etc/modprobe.d/30_security-misc_disable.conf index d6b5122..0158586 100644 --- a/etc/modprobe.d/30_security-misc_disable.conf +++ b/etc/modprobe.d/30_security-misc_disable.conf @@ -121,7 +121,7 @@ install nfsv4 /usr/bin/disabled-netfilesys-by-security-misc install af_802154 /usr/bin/disabled-network-by-security-misc install appletalk /usr/bin/disabled-network-by-security-misc install ax25 /usr/bin/disabled-network-by-security-misc -install brcm80211 /bin/true /usr/bin/disabled-network-by-security-misc +install brcm80211 /usr/bin/disabled-network-by-security-misc install decnet /usr/bin/disabled-network-by-security-misc install dccp /usr/bin/disabled-network-by-security-misc install econet /usr/bin/disabled-network-by-security-misc