From 780dc8eec99915a7466249e219ad59c5db5f0364 Mon Sep 17 00:00:00 2001 From: Raja Grewal Date: Fri, 8 Jul 2022 04:11:25 +1000 Subject: [PATCH] replace /bin/false -> /bin/disabled-by-security-misc --- etc/modprobe.d/30_security-misc.conf | 100 +++++++++++++-------------- usr/bin/disabled-by-security-misc | 10 +++ 2 files changed, 60 insertions(+), 50 deletions(-) create mode 100755 usr/bin/disabled-by-security-misc diff --git a/etc/modprobe.d/30_security-misc.conf b/etc/modprobe.d/30_security-misc.conf index 422fcd0..a855e79 100644 --- a/etc/modprobe.d/30_security-misc.conf +++ b/etc/modprobe.d/30_security-misc.conf @@ -11,24 +11,24 @@ options nf_conntrack nf_conntrack_helper=0 # Blacklist bluetooth to reduce attack surface due to extended history of security vulnerabilities # https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns -install bluetooth /bin/false -install btusb /bin/false +install bluetooth /bin/disabled-by-security-misc +install btusb /bin/disabled-by-security-misc # Blacklist thunderbolt and firewire modules to prevent some DMA attacks -install thunderbolt /bin/false -install firewire-core /bin/false -install firewire_core /bin/false -install firewire-ohci /bin/false -install firewire_ohci /bin/false -install ohci1394 /bin/false -install sbp2 /bin/false -install dv1394 /bin/false -install raw1394 /bin/false -install video1394 /bin/false -install firewire-sbp2 /bin/false +install thunderbolt /bin/disabled-by-security-misc +install firewire-core /bin/disabled-by-security-misc +install firewire_core /bin/disabled-by-security-misc +install firewire-ohci /bin/disabled-by-security-misc +install firewire_ohci /bin/disabled-by-security-misc +install ohci1394 /bin/disabled-by-security-misc +install sbp2 /bin/disabled-by-security-misc +install dv1394 /bin/disabled-by-security-misc +install raw1394 /bin/disabled-by-security-misc +install video1394 /bin/disabled-by-security-misc +install firewire-sbp2 /bin/disabled-by-security-misc # Blacklist CPU MSRs as they can be abused to write to arbitrary memory. -install msr /bin/false +install msr /bin/disabled-by-security-misc # Blacklists unneeded network protocols that will likely not be used as these may have unknown vulnerabilties. # @@ -38,54 +38,54 @@ install msr /bin/false # # > Other distributions like Ubuntu[1] and Fedora[2] already ship a blacklist for various network protocols which aren't much in use by users and have a poor security track record. # -install dccp /bin/false -install sctp /bin/false -install rds /bin/false -install tipc /bin/false -install n-hdlc /bin/false -install ax25 /bin/false -install netrom /bin/false -install x25 /bin/false -install rose /bin/false -install decnet /bin/false -install econet /bin/false -install af_802154 /bin/false -install ipx /bin/false -install appletalk /bin/false -install psnap /bin/false -install p8023 /bin/false -install p8022 /bin/false -install can /bin/false -install atm /bin/false +install dccp /bin/disabled-by-security-misc +install sctp /bin/disabled-by-security-misc +install rds /bin/disabled-by-security-misc +install tipc /bin/disabled-by-security-misc +install n-hdlc /bin/disabled-by-security-misc +install ax25 /bin/disabled-by-security-misc +install netrom /bin/disabled-by-security-misc +install x25 /bin/disabled-by-security-misc +install rose /bin/disabled-by-security-misc +install decnet /bin/disabled-by-security-misc +install econet /bin/disabled-by-security-misc +install af_802154 /bin/disabled-by-security-misc +install ipx /bin/disabled-by-security-misc +install appletalk /bin/disabled-by-security-misc +install psnap /bin/disabled-by-security-misc +install p8023 /bin/disabled-by-security-misc +install p8022 /bin/disabled-by-security-misc +install can /bin/disabled-by-security-misc +install atm /bin/disabled-by-security-misc # Blacklist uncommon file systems to reduce attack surface -install cramfs /bin/false -install freevxfs /bin/false -install jffs2 /bin/false -install hfs /bin/false -install hfsplus /bin/false -install udf /bin/false +install cramfs /bin/disabled-by-security-misc +install freevxfs /bin/disabled-by-security-misc +install jffs2 /bin/disabled-by-security-misc +install hfs /bin/disabled-by-security-misc +install hfsplus /bin/disabled-by-security-misc +install udf /bin/disabled-by-security-misc # Blacklist uncommon network file systems to reduce attack surface -install cifs /bin/false -install nfs /bin/false -install nfsv3 /bin/false -install nfsv4 /bin/false -install ksmbd /bin/false -install gfs2 /bin/false +install cifs /bin/disabled-by-security-misc +install nfs /bin/disabled-by-security-misc +install nfsv3 /bin/disabled-by-security-misc +install nfsv4 /bin/disabled-by-security-misc +install ksmbd /bin/disabled-by-security-misc +install gfs2 /bin/disabled-by-security-misc # Blacklists the vivid kernel module as it's only required for testing and has been the cause of multiple vulnerabilities # https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233 # https://www.openwall.com/lists/oss-security/2019/11/02/1 # https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475 -install vivid /bin/false +install vivid /bin/disabled-by-security-misc # Blacklist CD-ROM devices # https://nvd.nist.gov/vuln/detail/CVE-2018-11506 -install cdrom /bin/false -install sr_mod /bin/false +install cdrom /bin/disabled-by-security-misc +install sr_mod /bin/disabled-by-security-misc # Blacklist Intel Management Engine (ME) interface with the OS # https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html -install mei /bin/false -install mei-me /bin/false +install mei /bin/disabled-by-security-misc +install mei-me /bin/disabled-by-security-misc diff --git a/usr/bin/disabled-by-security-misc b/usr/bin/disabled-by-security-misc new file mode 100755 index 0000000..9d11c80 --- /dev/null +++ b/usr/bin/disabled-by-security-misc @@ -0,0 +1,10 @@ +#!/bin/bash + +## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP +## See the file COPYING for copying conditions. + +## Alerts the user that a kernel module failed to load due to it being blacklisted by default. + +echo "$0: ERROR: This kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2 + +exit 1