|
|
|
@ -16,7 +16,22 @@
|
|
|
|
|
## Now replaced by a privacy and security preserving default Bluetooth configuration for better usability.
|
|
|
|
|
##
|
|
|
|
|
#install bluetooth /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install bluetooth_6lowpan /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install bt3c_cs /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install btbcm /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install btintel /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install btmrvl /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install btmrvl_sdio /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install btmtk /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install btmtksdio /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install btmtkuart /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install btnxpuart /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install btqca /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install btrsi /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install btrtl /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install btsdio /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install btusb /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
#install virtio_bt /usr/bin/disabled-bluetooth-by-security-misc
|
|
|
|
|
|
|
|
|
|
## CPU Model-Specific Registers (MSRs):
|
|
|
|
|
## Disable CPU MSRs as they can be abused to write to arbitrary memory.
|
|
|
|
@ -24,7 +39,7 @@
|
|
|
|
|
## https://security.stackexchange.com/questions/119712/methods-root-can-use-to-elevate-itself-to-kernel-mode
|
|
|
|
|
## https://github.com/Kicksecure/security-misc/issues/215
|
|
|
|
|
##
|
|
|
|
|
#install msr /usr/bin/disabled-msr-by-security-misc
|
|
|
|
|
#install msr /usr/bin/disabled-miscellaneous-by-security-misc
|
|
|
|
|
|
|
|
|
|
## File Systems:
|
|
|
|
|
## Disable uncommon file systems to reduce attack surface.
|
|
|
|
@ -35,6 +50,8 @@ install freevxfs /usr/bin/disabled-filesys-by-security-misc
|
|
|
|
|
install hfs /usr/bin/disabled-filesys-by-security-misc
|
|
|
|
|
install hfsplus /usr/bin/disabled-filesys-by-security-misc
|
|
|
|
|
install jffs2 /usr/bin/disabled-filesys-by-security-misc
|
|
|
|
|
install jfs /usr/bin/disabled-filesys-by-security-misc
|
|
|
|
|
install reiserfs /usr/bin/disabled-filesys-by-security-misc
|
|
|
|
|
install udf /usr/bin/disabled-filesys-by-security-misc
|
|
|
|
|
|
|
|
|
|
## FireWire (IEEE 1394):
|
|
|
|
@ -55,6 +72,7 @@ install video1394 /usr/bin/disabled-firewire-by-security-misc
|
|
|
|
|
## Global Positioning Systems (GPS):
|
|
|
|
|
## Disable GPS-related modules like GNSS (Global Navigation Satellite System).
|
|
|
|
|
##
|
|
|
|
|
install garmin_gps /usr/bin/disabled-gps-by-security-misc
|
|
|
|
|
install gnss /usr/bin/disabled-gps-by-security-misc
|
|
|
|
|
install gnss-mtk /usr/bin/disabled-gps-by-security-misc
|
|
|
|
|
install gnss-serial /usr/bin/disabled-gps-by-security-misc
|
|
|
|
@ -73,10 +91,23 @@ install mei-me /usr/bin/disabled-intelme-by-security-misc
|
|
|
|
|
## Network File Systems:
|
|
|
|
|
## Disable uncommon network file systems to reduce attack surface.
|
|
|
|
|
##
|
|
|
|
|
install cifs /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
install gfs2 /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
install ksmbd /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
##
|
|
|
|
|
## Common Internet File System (CIFS):
|
|
|
|
|
##
|
|
|
|
|
install cifs /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
install cifs_arc4 /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
install cifs_md4 /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
##
|
|
|
|
|
## Network File System (NFS):
|
|
|
|
|
##
|
|
|
|
|
install nfs /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
install nfs_acl /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
install nfs_layout_nfsv41_files /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
install nfs_layout_flexfiles /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
install nfsd /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
install nfsv2 /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
install nfsv3 /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
install nfsv4 /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
|
|
|
|
@ -84,31 +115,84 @@ install nfsv4 /usr/bin/disabled-netfilesys-by-security-misc
|
|
|
|
|
## Disables rare and unneeded network protocols that are a common source of unknown vulnerabilities.
|
|
|
|
|
##
|
|
|
|
|
## https://tails.boum.org/blueprint/blacklist_modules/
|
|
|
|
|
## https://fedoraproject.org/wiki/Security_Features_Matrix#Blacklist_Rare_Protocols)
|
|
|
|
|
## https://fedoraproject.org/wiki/Security_Features_Matrix#Blacklist_Rare_Protocols
|
|
|
|
|
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-rare-network.conf?h=ubuntu/disco
|
|
|
|
|
##
|
|
|
|
|
install af_802154 /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install appletalk /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install atm /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install ax25 /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install can /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install brcm80211 /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install decnet /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install dccp /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install econet /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install eepro100 /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install eth1394 /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install ipx /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install n-hdlc /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install netrom /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install p8022 /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install p8023 /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install psnap /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install rds /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install rose /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install sctp /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install tipc /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install x25 /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
##
|
|
|
|
|
## Asynchronous Transfer Mode (ATM):
|
|
|
|
|
##
|
|
|
|
|
install atm /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install ueagle-atm /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install usbatm /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install xusbatm /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
##
|
|
|
|
|
## Controller Area Network (CAN) Protocol:
|
|
|
|
|
##
|
|
|
|
|
install c_can /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install c_can_pci /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install c_can_platform /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install can /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install can-bcm /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install can-dev /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install can-gw /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install can-isotp /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install can-raw /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install can-j1939 /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install can327 /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install ifi_canfd /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install janz-ican3 /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install m_can /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install m_can_pci /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install m_can_platform /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install phy-can-transceiver /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install slcan /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install ucan /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install vxcan /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install vcan /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
##
|
|
|
|
|
## Transparent Inter Process Communication (TIPC):
|
|
|
|
|
##
|
|
|
|
|
install tipc /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install tipc_diag /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
##
|
|
|
|
|
## Reliable Datagram Sockets (RDS):
|
|
|
|
|
##
|
|
|
|
|
install rds /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install rds_rdma /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install rds_tcp /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
##
|
|
|
|
|
## Stream Control Transmission Protocol (SCTP):
|
|
|
|
|
##
|
|
|
|
|
install sctp /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
install sctp_diag /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
|
|
|
|
|
## Miscellaneous:
|
|
|
|
|
##
|
|
|
|
|
## Amateur Radios:
|
|
|
|
|
##
|
|
|
|
|
install hamradio /usr/bin/disabled-miscellaneous-by-security-misc
|
|
|
|
|
##
|
|
|
|
|
## Floppy Disks:
|
|
|
|
|
##
|
|
|
|
|
install floppy /usr/bin/disabled-miscellaneous-by-security-misc
|
|
|
|
|
##
|
|
|
|
|
## Vivid:
|
|
|
|
|
## Disables the vivid kernel module since it has been the cause of multiple vulnerabilities.
|
|
|
|
|
##
|
|
|
|
@ -116,11 +200,13 @@ install x25 /usr/bin/disabled-network-by-security-misc
|
|
|
|
|
## https://www.openwall.com/lists/oss-security/2019/11/02/1
|
|
|
|
|
## https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475
|
|
|
|
|
##
|
|
|
|
|
install vivid /usr/bin/disabled-vivid-by-security-misc
|
|
|
|
|
install vivid /usr/bin/disabled-miscellaneous-by-security-misc
|
|
|
|
|
|
|
|
|
|
## Thunderbolt:
|
|
|
|
|
## Disables Thunderbolt modules to prevent some DMA attacks.
|
|
|
|
|
##
|
|
|
|
|
## https://en.wikipedia.org/wiki/Thunderbolt_(interface)#Security_vulnerabilities
|
|
|
|
|
##
|
|
|
|
|
install intel-wmi-thunderbolt /usr/bin/disabled-thunderbolt-by-security-misc
|
|
|
|
|
install thunderbolt /usr/bin/disabled-thunderbolt-by-security-misc
|
|
|
|
|
install thunderbolt_net /usr/bin/disabled-thunderbolt-by-security-misc
|
|
|
|
|