Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-11-25 11:46:23 -05:00
Code Issues Projects Releases Packages Wiki Activity

Move (optional) CPU MSR module disable list

Browse source
This commit is contained in:
raja-grewal 2025-11-21 13:05:13 +00:00 • committed by GitHub
parent 1a7b0a9122
commit 79be87ec5f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 24 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

4
README.md
View file

@ -344,6 +344,8 @@ Hardware modules:
- Optional - Bluetooth: Disabled to reduce attack surface.
- Optional - CPU MSRs: Disabled as can be abused to write to arbitrary memory.
- FireWire (IEEE 1394): Disabled as they are often vulnerable to DMA attacks.
- GPS: Disable GPS-related modules such as those required for Global Navigation
@ -373,8 +375,6 @@ Miscellaneous modules:
- Amateur Radios: Disabled to reduce attack surface.
- Optional - CPU MSRs: Disabled as can be abused to write to arbitrary memory.
- Floppy Disks: Disabled to reduce attack surface.
- Framebuffer (fbdev): Disabled as these drivers are well-known to be buggy, cause

24
etc/modprobe.d/30_security-misc_disable.conf#security-misc-shared
View file

@ -41,6 +41,18 @@
#install btusb /usr/bin/disabled-bluetooth-by-security-misc
#install virtio_bt /usr/bin/disabled-bluetooth-by-security-misc
## CPU Model-Specific Registers (MSRs):
## Can disable CPU MSRs as they can be abused to write to arbitrary memory.
##
## https://en.wikipedia.org/wiki/Model-specific_register
## https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/reading-writing-msrs-in-linux.html
## https://security.stackexchange.com/questions/119712/methods-root-can-use-to-elevate-itself-to-kernel-mode
## https://github.com/Kicksecure/security-misc/issues/215
##
#install intel_rapl_msr /usr/bin/disabled-cpumsr-by-security-misc
#install isst_if_mbox_msr /usr/bin/disabled-cpumsr-by-security-misc
#install msr /usr/bin/disabled-cpumsr-by-security-misc
## FireWire (IEEE 1394):
## Disable IEEE 1394 (FireWire/i.LINK/Lynx) modules to prevent certain DMA attacks.
##
@ -251,18 +263,6 @@ install sctp_diag /usr/bin/disabled-network-by-security-misc
##
install hamradio /usr/bin/disabled-miscellaneous-by-security-misc
## CPU Model-Specific Registers (MSRs):
## Can disable CPU MSRs as they can be abused to write to arbitrary memory.
##
## https://en.wikipedia.org/wiki/Model-specific_register
## https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/reading-writing-msrs-in-linux.html
## https://security.stackexchange.com/questions/119712/methods-root-can-use-to-elevate-itself-to-kernel-mode
## https://github.com/Kicksecure/security-misc/issues/215
##
#install intel_rapl_msr /usr/bin/disabled-miscellaneous-by-security-misc
#install isst_if_mbox_msr /usr/bin/disabled-miscellaneous-by-security-misc
#install msr /usr/bin/disabled-miscellaneous-by-security-misc
## Floppy Disks:
##
install floppy /usr/bin/disabled-miscellaneous-by-security-misc

10
usr/bin/disabled-cpumsr-by-security-misc#security-misc-shared Executable file
View file

@ -0,0 +1,10 @@
#!/bin/bash
## Copyright (C) 2019 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.
## Alerts user that a kernel module failed to load due to it being explicitly disabled by default.
echo "$0: ALERT: This CPU MSR kernel module is disabled by package security-misc-shared by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2
exit 1