Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-02-02 17:54:43 -05:00
Code Issues Packages Projects Releases Wiki Activity

replace /bin/false -> /bin/disabled-by-security-misc

Browse Source
This commit is contained in:
Raja Grewal 2022-07-08 04:11:25 +10:00
parent fa2e30f512
commit 780dc8eec9
No known key found for this signature in database
GPG Key ID: E34A5801947020A5
2 changed files with 60 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

100
etc/modprobe.d/30_security-misc.conf
View File

@ -11,24 +11,24 @@ options nf_conntrack nf_conntrack_helper=0
# Blacklist bluetooth to reduce attack surface due to extended history of security vulnerabilities # Blacklist bluetooth to reduce attack surface due to extended history of security vulnerabilities
# https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns # https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns
install bluetooth /bin/false install bluetooth /bin/disabled-by-security-misc
install btusb /bin/false install btusb /bin/disabled-by-security-misc
# Blacklist thunderbolt and firewire modules to prevent some DMA attacks # Blacklist thunderbolt and firewire modules to prevent some DMA attacks
install thunderbolt /bin/false install thunderbolt /bin/disabled-by-security-misc
install firewire-core /bin/false install firewire-core /bin/disabled-by-security-misc
install firewire_core /bin/false install firewire_core /bin/disabled-by-security-misc
install firewire-ohci /bin/false install firewire-ohci /bin/disabled-by-security-misc
install firewire_ohci /bin/false install firewire_ohci /bin/disabled-by-security-misc
install ohci1394 /bin/false install ohci1394 /bin/disabled-by-security-misc
install sbp2 /bin/false install sbp2 /bin/disabled-by-security-misc
install dv1394 /bin/false install dv1394 /bin/disabled-by-security-misc
install raw1394 /bin/false install raw1394 /bin/disabled-by-security-misc
install video1394 /bin/false install video1394 /bin/disabled-by-security-misc
install firewire-sbp2 /bin/false install firewire-sbp2 /bin/disabled-by-security-misc
# Blacklist CPU MSRs as they can be abused to write to arbitrary memory. # Blacklist CPU MSRs as they can be abused to write to arbitrary memory.
install msr /bin/false install msr /bin/disabled-by-security-misc
# Blacklists unneeded network protocols that will likely not be used as these may have unknown vulnerabilties. # Blacklists unneeded network protocols that will likely not be used as these may have unknown vulnerabilties.
# #
@ -38,54 +38,54 @@ install msr /bin/false
# #
# > Other distributions like Ubuntu[1] and Fedora[2] already ship a blacklist for various network protocols which aren't much in use by users and have a poor security track record. # > Other distributions like Ubuntu[1] and Fedora[2] already ship a blacklist for various network protocols which aren't much in use by users and have a poor security track record.
# #
install dccp /bin/false install dccp /bin/disabled-by-security-misc
install sctp /bin/false install sctp /bin/disabled-by-security-misc
install rds /bin/false install rds /bin/disabled-by-security-misc
install tipc /bin/false install tipc /bin/disabled-by-security-misc
install n-hdlc /bin/false install n-hdlc /bin/disabled-by-security-misc
install ax25 /bin/false install ax25 /bin/disabled-by-security-misc
install netrom /bin/false install netrom /bin/disabled-by-security-misc
install x25 /bin/false install x25 /bin/disabled-by-security-misc
install rose /bin/false install rose /bin/disabled-by-security-misc
install decnet /bin/false install decnet /bin/disabled-by-security-misc
install econet /bin/false install econet /bin/disabled-by-security-misc
install af_802154 /bin/false install af_802154 /bin/disabled-by-security-misc
install ipx /bin/false install ipx /bin/disabled-by-security-misc
install appletalk /bin/false install appletalk /bin/disabled-by-security-misc
install psnap /bin/false install psnap /bin/disabled-by-security-misc
install p8023 /bin/false install p8023 /bin/disabled-by-security-misc
install p8022 /bin/false install p8022 /bin/disabled-by-security-misc
install can /bin/false install can /bin/disabled-by-security-misc
install atm /bin/false install atm /bin/disabled-by-security-misc
# Blacklist uncommon file systems to reduce attack surface # Blacklist uncommon file systems to reduce attack surface
install cramfs /bin/false install cramfs /bin/disabled-by-security-misc
install freevxfs /bin/false install freevxfs /bin/disabled-by-security-misc
install jffs2 /bin/false install jffs2 /bin/disabled-by-security-misc
install hfs /bin/false install hfs /bin/disabled-by-security-misc
install hfsplus /bin/false install hfsplus /bin/disabled-by-security-misc
install udf /bin/false install udf /bin/disabled-by-security-misc
# Blacklist uncommon network file systems to reduce attack surface # Blacklist uncommon network file systems to reduce attack surface
install cifs /bin/false install cifs /bin/disabled-by-security-misc
install nfs /bin/false install nfs /bin/disabled-by-security-misc
install nfsv3 /bin/false install nfsv3 /bin/disabled-by-security-misc
install nfsv4 /bin/false install nfsv4 /bin/disabled-by-security-misc
install ksmbd /bin/false install ksmbd /bin/disabled-by-security-misc
install gfs2 /bin/false install gfs2 /bin/disabled-by-security-misc
# Blacklists the vivid kernel module as it's only required for testing and has been the cause of multiple vulnerabilities # Blacklists the vivid kernel module as it's only required for testing and has been the cause of multiple vulnerabilities
# https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233 # https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233
# https://www.openwall.com/lists/oss-security/2019/11/02/1 # https://www.openwall.com/lists/oss-security/2019/11/02/1
# https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475 # https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475
install vivid /bin/false install vivid /bin/disabled-by-security-misc
# Blacklist CD-ROM devices # Blacklist CD-ROM devices
# https://nvd.nist.gov/vuln/detail/CVE-2018-11506 # https://nvd.nist.gov/vuln/detail/CVE-2018-11506
install cdrom /bin/false install cdrom /bin/disabled-by-security-misc
install sr_mod /bin/false install sr_mod /bin/disabled-by-security-misc
# Blacklist Intel Management Engine (ME) interface with the OS # Blacklist Intel Management Engine (ME) interface with the OS
# https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html # https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html
install mei /bin/false install mei /bin/disabled-by-security-misc
install mei-me /bin/false install mei-me /bin/disabled-by-security-misc

10
usr/bin/disabled-by-security-misc Executable file
View File

@ -0,0 +1,10 @@
#!/bin/bash
## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Alerts the user that a kernel module failed to load due to it being blacklisted by default.
echo "$0: ERROR: This kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc.conf | args: $@" >&2
exit 1