Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-05-04 09:44:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

allow loading unsigned modules due to issues

Browse source 
https://forums.whonix.org/t/allow-loading-signed-kernel-modules-by-default-disallow-kernel-module-loading-by-default/7880/23
This commit is contained in:
Patrick Schleizer 2019-09-07 05:39:56 +00:00
parent 9ee9309f54
commit 661bcd8603
No known key found for this signature in database
GPG key ID: CB8D50BB77BB3C48
3 changed files with 3 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

5
debian/control vendored
View file

@ -80,11 +80,6 @@ Description: enhances misc security settings
* Bluetooth is blacklisted to reduce attack surface. Bluetooth also has * Bluetooth is blacklisted to reduce attack surface. Bluetooth also has
a history of security concerns. a history of security concerns.
https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns
.
* Requires every module to be signed before being loaded. Any module that is
unsigned or signed with an invalid key cannot be loaded. This makes it harder
to load a malicious module.
/etc/default/grub.d/40_only_allow_signed_modules.cfg
. .
Uncommon network protocols are blacklisted: Uncommon network protocols are blacklisted:
These are rarely used and may have unknown vulnerabilities. These are rarely used and may have unknown vulnerabilities.

3
debian/security-misc.maintscript vendored
View file

@ -2,3 +2,6 @@
## See the file COPYING for copying conditions. ## See the file COPYING for copying conditions.
rm_conffile /etc/sudoers.d/umask-security-misc rm_conffile /etc/sudoers.d/umask-security-misc
## https://forums.whonix.org/t/allow-loading-signed-kernel-modules-by-default-disallow-kernel-module-loading-by-default/7880/23
rm_conffile /etc/default/grub.d/40_only_allow_signed_modules.cfg

4
etc/default/grub.d/40_only_allow_signed_modules.cfg
View file

@ -1,4 +0,0 @@
## Requires every module to be signed before being loaded.
## Any module that is unsigned or signed with an invalid key cannot be loaded.
## This makes it harder to load a malicious module.
GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX module.sig_enforce=1"