From 48089e5ba43b0b72449f888b98b63119ed57e2fd Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Tue, 12 Jul 2022 17:02:12 +1000 Subject: [PATCH] More verbose kernel module blocking error logs --- .../block-bluetooth | 10 ++ .../block-cdrom | 10 ++ .../block-filesys | 10 ++ .../block-firewire | 10 ++ .../block-intelme | 10 ++ .../block-msr | 10 ++ .../block-netfilesys | 10 ++ .../block-network | 10 ++ .../block-thunderbolt | 10 ++ .../block-vivid | 10 ++ etc/modprobe.d/30_security-misc.conf | 102 +++++++++--------- 11 files changed, 151 insertions(+), 51 deletions(-) create mode 100755 bin/disabled-module-by-security-misc/block-bluetooth create mode 100755 bin/disabled-module-by-security-misc/block-cdrom create mode 100755 bin/disabled-module-by-security-misc/block-filesys create mode 100755 bin/disabled-module-by-security-misc/block-firewire create mode 100755 bin/disabled-module-by-security-misc/block-intelme create mode 100755 bin/disabled-module-by-security-misc/block-msr create mode 100755 bin/disabled-module-by-security-misc/block-netfilesys create mode 100755 bin/disabled-module-by-security-misc/block-network create mode 100755 bin/disabled-module-by-security-misc/block-thunderbolt create mode 100755 bin/disabled-module-by-security-misc/block-vivid diff --git a/bin/disabled-module-by-security-misc/block-bluetooth b/bin/disabled-module-by-security-misc/block-bluetooth new file mode 100755 index 0000000..e708783 --- /dev/null +++ b/bin/disabled-module-by-security-misc/block-bluetooth @@ -0,0 +1,10 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP +## See the file COPYING for copying conditions. + +## Alerts the user that a kernel module failed to load due to it being blacklisted by default. + +echo "$0: ERROR: This bluetooth kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 + +exit 1 diff --git a/bin/disabled-module-by-security-misc/block-cdrom b/bin/disabled-module-by-security-misc/block-cdrom new file mode 100755 index 0000000..5057e32 --- /dev/null +++ b/bin/disabled-module-by-security-misc/block-cdrom @@ -0,0 +1,10 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP +## See the file COPYING for copying conditions. + +## Alerts the user that a kernel module failed to load due to it being blacklisted by default. + +echo "$0: ERROR: This CD-ROM kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 + +exit 1 diff --git a/bin/disabled-module-by-security-misc/block-filesys b/bin/disabled-module-by-security-misc/block-filesys new file mode 100755 index 0000000..9050a8c --- /dev/null +++ b/bin/disabled-module-by-security-misc/block-filesys @@ -0,0 +1,10 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP +## See the file COPYING for copying conditions. + +## Alerts the user that a kernel module failed to load due to it being blacklisted by default. + +echo "$0: ERROR: This file system kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 + +exit 1 diff --git a/bin/disabled-module-by-security-misc/block-firewire b/bin/disabled-module-by-security-misc/block-firewire new file mode 100755 index 0000000..5aa44e3 --- /dev/null +++ b/bin/disabled-module-by-security-misc/block-firewire @@ -0,0 +1,10 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP +## See the file COPYING for copying conditions. + +## Alerts the user that a kernel module failed to load due to it being blacklisted by default. + +echo "$0: ERROR: This firewire kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 + +exit 1 diff --git a/bin/disabled-module-by-security-misc/block-intelme b/bin/disabled-module-by-security-misc/block-intelme new file mode 100755 index 0000000..9c8c96c --- /dev/null +++ b/bin/disabled-module-by-security-misc/block-intelme @@ -0,0 +1,10 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP +## See the file COPYING for copying conditions. + +## Alerts the user that a kernel module failed to load due to it being blacklisted by default. + +echo "$0: ERROR: This Intel Management Engine (ME) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 + +exit 1 diff --git a/bin/disabled-module-by-security-misc/block-msr b/bin/disabled-module-by-security-misc/block-msr new file mode 100755 index 0000000..3cf3937 --- /dev/null +++ b/bin/disabled-module-by-security-misc/block-msr @@ -0,0 +1,10 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP +## See the file COPYING for copying conditions. + +## Alerts the user that a kernel module failed to load due to it being blacklisted by default. + +echo "$0: ERROR: This CPU MSR kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 + +exit 1 diff --git a/bin/disabled-module-by-security-misc/block-netfilesys b/bin/disabled-module-by-security-misc/block-netfilesys new file mode 100755 index 0000000..0dc5672 --- /dev/null +++ b/bin/disabled-module-by-security-misc/block-netfilesys @@ -0,0 +1,10 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP +## See the file COPYING for copying conditions. + +## Alerts the user that a kernel module failed to load due to it being blacklisted by default. + +echo "$0: ERROR: This network file system kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 + +exit 1 diff --git a/bin/disabled-module-by-security-misc/block-network b/bin/disabled-module-by-security-misc/block-network new file mode 100755 index 0000000..7cb3041 --- /dev/null +++ b/bin/disabled-module-by-security-misc/block-network @@ -0,0 +1,10 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP +## See the file COPYING for copying conditions. + +## Alerts the user that a kernel module failed to load due to it being blacklisted by default. + +echo "$0: ERROR: This network protocol kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 + +exit 1 diff --git a/bin/disabled-module-by-security-misc/block-thunderbolt b/bin/disabled-module-by-security-misc/block-thunderbolt new file mode 100755 index 0000000..bfb52e1 --- /dev/null +++ b/bin/disabled-module-by-security-misc/block-thunderbolt @@ -0,0 +1,10 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP +## See the file COPYING for copying conditions. + +## Alerts the user that a kernel module failed to load due to it being blacklisted by default. + +echo "$0: ERROR: This thunderbolt kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 + +exit 1 diff --git a/bin/disabled-module-by-security-misc/block-vivid b/bin/disabled-module-by-security-misc/block-vivid new file mode 100755 index 0000000..45c14bd --- /dev/null +++ b/bin/disabled-module-by-security-misc/block-vivid @@ -0,0 +1,10 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP +## See the file COPYING for copying conditions. + +## Alerts the user that a kernel module failed to load due to it being blacklisted by default. + +echo "$0: ERROR: This vivid kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 + +exit 1 diff --git a/etc/modprobe.d/30_security-misc.conf b/etc/modprobe.d/30_security-misc.conf index b6c8424..fa219bf 100644 --- a/etc/modprobe.d/30_security-misc.conf +++ b/etc/modprobe.d/30_security-misc.conf @@ -11,77 +11,77 @@ options nf_conntrack nf_conntrack_helper=0 ## Disable bluetooth to reduce attack surface due to extended history of security vulnerabilities ## https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns -install bluetooth /bin/disabled-by-security-misc -install btusb /bin/disabled-by-security-misc +install bluetooth /bin/disabled-module-by-security-misc/block-bluetooth +install btusb /bin/disabled-module-by-security-misc/block-bluetooth ## Disable thunderbolt and firewire modules to prevent some DMA attacks -install thunderbolt /bin/disabled-by-security-misc -install firewire-core /bin/disabled-by-security-misc -install firewire_core /bin/disabled-by-security-misc -install firewire-ohci /bin/disabled-by-security-misc -install firewire_ohci /bin/disabled-by-security-misc -install firewire_sbp2 /bin/disabled-by-security-misc -install firewire-sbp2 /bin/disabled-by-security-misc -install ohci1394 /bin/disabled-by-security-misc -install sbp2 /bin/disabled-by-security-misc -install dv1394 /bin/disabled-by-security-misc -install raw1394 /bin/disabled-by-security-misc -install video1394 /bin/disabled-by-security-misc +install thunderbolt /bin/disabled-module-by-security-misc/block-thunderbolt +install firewire-core /bin/disabled-module-by-security-misc/block-firewire +install firewire_core /bin/disabled-module-by-security-misc/block-firewire +install firewire-ohci /bin/disabled-module-by-security-misc/block-firewire +install firewire_ohci /bin/disabled-module-by-security-misc/block-firewire +install firewire_sbp2 /bin/disabled-module-by-security-misc/block-firewire +install firewire-sbp2 /bin/disabled-module-by-security-misc/block-firewire +install ohci1394 /bin/disabled-module-by-security-misc/block-firewire +install sbp2 /bin/disabled-module-by-security-misc/block-firewire +install dv1394 /bin/disabled-module-by-security-misc/block-firewire +install raw1394 /bin/disabled-module-by-security-misc/block-firewire +install video1394 /bin/disabled-module-by-security-misc/block-firewire ## Disable CPU MSRs as they can be abused to write to arbitrary memory. ## https://security.stackexchange.com/questions/119712/methods-root-can-use-to-elevate-itself-to-kernel-mode -install msr /bin/disabled-by-security-misc +install msr /bin/disabled-module-by-security-misc/block-msr ## Disables unneeded network protocols that will likely not be used as these may have unknown vulnerabilties. ## Credit to Tails (https://tails.boum.org/blueprint/blacklist_modules/) for some of these. ## > Debian ships a long list of modules for wide support of devices, filesystems, protocols. Some of these modules have a pretty bad security track record, and some of those are simply not used by most of our users. ## > Other distributions like Ubuntu[1] and Fedora[2] already ship a blacklist for various network protocols which aren't much in use by users and have a poor security track record. -install dccp /bin/disabled-by-security-misc -install sctp /bin/disabled-by-security-misc -install rds /bin/disabled-by-security-misc -install tipc /bin/disabled-by-security-misc -install n-hdlc /bin/disabled-by-security-misc -install ax25 /bin/disabled-by-security-misc -install netrom /bin/disabled-by-security-misc -install x25 /bin/disabled-by-security-misc -install rose /bin/disabled-by-security-misc -install decnet /bin/disabled-by-security-misc -install econet /bin/disabled-by-security-misc -install af_802154 /bin/disabled-by-security-misc -install ipx /bin/disabled-by-security-misc -install appletalk /bin/disabled-by-security-misc -install psnap /bin/disabled-by-security-misc -install p8023 /bin/disabled-by-security-misc -install p8022 /bin/disabled-by-security-misc -install can /bin/disabled-by-security-misc -install atm /bin/disabled-by-security-misc +install dccp /bin/disabled-module-by-security-misc/block-network +install sctp /bin/disabled-module-by-security-misc/block-network +install rds /bin/disabled-module-by-security-misc/block-network +install tipc /bin/disabled-module-by-security-misc/block-network +install n-hdlc /bin/disabled-module-by-security-misc/block-network +install ax25 /bin/disabled-module-by-security-misc/block-network +install netrom /bin/disabled-module-by-security-misc/block-network +install x25 /bin/disabled-module-by-security-misc/block-network +install rose /bin/disabled-module-by-security-misc/block-network +install decnet /bin/disabled-module-by-security-misc/block-network +install econet /bin/disabled-module-by-security-misc/block-network +install af_802154 /bin/disabled-module-by-security-misc/block-network +install ipx /bin/disabled-module-by-security-misc/block-network +install appletalk /bin/disabled-module-by-security-misc/block-network +install psnap /bin/disabled-module-by-security-misc/block-network +install p8023 /bin/disabled-module-by-security-misc/block-network +install p8022 /bin/disabled-module-by-security-misc/block-network +install can /bin/disabled-module-by-security-misc/block-network +install atm /bin/disabled-module-by-security-misc/block-network ## Disable uncommon file systems to reduce attack surface -install cramfs /bin/disabled-by-security-misc -install freevxfs /bin/disabled-by-security-misc -install jffs2 /bin/disabled-by-security-misc -install hfs /bin/disabled-by-security-misc -install hfsplus /bin/disabled-by-security-misc -install udf /bin/disabled-by-security-misc +install cramfs /bin/disabled-module-by-security-misc/block-filesys +install freevxfs /bin/disabled-module-by-security-misc/block-filesys +install jffs2 /bin/disabled-module-by-security-misc/block-filesys +install hfs /bin/disabled-module-by-security-misc/block-filesys +install hfsplus /bin/disabled-module-by-security-misc/block-filesys +install udf /bin/disabled-module-by-security-misc/block-filesys ## Disable uncommon network file systems to reduce attack surface -install cifs /bin/disabled-by-security-misc -install nfs /bin/disabled-by-security-misc -install nfsv3 /bin/disabled-by-security-misc -install nfsv4 /bin/disabled-by-security-misc -install ksmbd /bin/disabled-by-security-misc -install gfs2 /bin/disabled-by-security-misc +install cifs /bin/disabled-module-by-security-misc/block-netfilesys +install nfs /bin/disabled-module-by-security-misc/block-netfilesys +install nfsv3 /bin/disabled-module-by-security-misc/block-netfilesys +install nfsv4 /bin/disabled-module-by-security-misc/block-netfilesys +install ksmbd /bin/disabled-module-by-security-misc/block-netfilesys +install gfs2 /bin/disabled-module-by-security-misc/block-netfilesys ## Disables the vivid kernel module as it's only required for testing and has been the cause of multiple vulnerabilities ## https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233 ## https://www.openwall.com/lists/oss-security/2019/11/02/1 ## https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475 -install vivid /bin/disabled-by-security-misc +install vivid /bin/disabled-module-by-security-misc/block-vivid ## Disable Intel Management Engine (ME) interface with the OS ## https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html -install mei /bin/disabled-by-security-misc -install mei-me /bin/disabled-by-security-misc +install mei /bin/disabled-module-by-security-misc/block-intelme +install mei-me /bin/disabled-module-by-security-misc/block-intelme ## Blacklist automatic loading of the Atheros 5K RF MACs madwifi driver ## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-ath_pci.conf?h=ubuntu/disco @@ -139,7 +139,7 @@ blacklist udlfb ## Disable CD-ROM devices ## https://nvd.nist.gov/vuln/detail/CVE-2018-11506 ## https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31 -#install cdrom /bin/disabled-by-security-misc -#install sr_mod /bin/disabled-by-security-misc +#install cdrom /bin/disabled-module-by-security-misc/block-cdrom +#install sr_mod /bin/disabled-module-by-security-misc/block-cdrom blacklist cdrom blacklist sr_mod