mirror of
https://github.com/Kicksecure/security-misc.git
synced 2024-10-01 08:25:45 -04:00
26b2c9727f
https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31
93 lines
4.4 KiB
Plaintext
93 lines
4.4 KiB
Plaintext
## Copyright (C) 2012 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
|
|
## See the file COPYING for copying conditions.
|
|
|
|
# See the following links for a community discussion and overview regarding the selections
|
|
# https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989
|
|
# https://madaidans-insecurities.github.io/guides/linux-hardening.html#kasr-kernel-modules
|
|
|
|
# Blacklist automatic conntrack helper assignment
|
|
# https://phabricator.whonix.org/T486
|
|
options nf_conntrack nf_conntrack_helper=0
|
|
|
|
# Blacklist bluetooth to reduce attack surface due to extended history of security vulnerabilities
|
|
# https://en.wikipedia.org/wiki/Bluetooth#History_of_security_concerns
|
|
install bluetooth /bin/disabled-by-security-misc
|
|
install btusb /bin/disabled-by-security-misc
|
|
|
|
# Blacklist thunderbolt and firewire modules to prevent some DMA attacks
|
|
install thunderbolt /bin/disabled-by-security-misc
|
|
install firewire-core /bin/disabled-by-security-misc
|
|
install firewire_core /bin/disabled-by-security-misc
|
|
install firewire-ohci /bin/disabled-by-security-misc
|
|
install firewire_ohci /bin/disabled-by-security-misc
|
|
install ohci1394 /bin/disabled-by-security-misc
|
|
install sbp2 /bin/disabled-by-security-misc
|
|
install dv1394 /bin/disabled-by-security-misc
|
|
install raw1394 /bin/disabled-by-security-misc
|
|
install video1394 /bin/disabled-by-security-misc
|
|
install firewire-sbp2 /bin/disabled-by-security-misc
|
|
|
|
# Blacklist CPU MSRs as they can be abused to write to arbitrary memory.
|
|
install msr /bin/disabled-by-security-misc
|
|
|
|
# Blacklists unneeded network protocols that will likely not be used as these may have unknown vulnerabilties.
|
|
#
|
|
# Credit to Tails (https://tails.boum.org/blueprint/blacklist_modules/) for some of these.
|
|
#
|
|
# > Debian ships a long list of modules for wide support of devices, filesystems, protocols. Some of these modules have a pretty bad security track record, and some of those are simply not used by most of our users.
|
|
#
|
|
# > Other distributions like Ubuntu[1] and Fedora[2] already ship a blacklist for various network protocols which aren't much in use by users and have a poor security track record.
|
|
#
|
|
install dccp /bin/disabled-by-security-misc
|
|
install sctp /bin/disabled-by-security-misc
|
|
install rds /bin/disabled-by-security-misc
|
|
install tipc /bin/disabled-by-security-misc
|
|
install n-hdlc /bin/disabled-by-security-misc
|
|
install ax25 /bin/disabled-by-security-misc
|
|
install netrom /bin/disabled-by-security-misc
|
|
install x25 /bin/disabled-by-security-misc
|
|
install rose /bin/disabled-by-security-misc
|
|
install decnet /bin/disabled-by-security-misc
|
|
install econet /bin/disabled-by-security-misc
|
|
install af_802154 /bin/disabled-by-security-misc
|
|
install ipx /bin/disabled-by-security-misc
|
|
install appletalk /bin/disabled-by-security-misc
|
|
install psnap /bin/disabled-by-security-misc
|
|
install p8023 /bin/disabled-by-security-misc
|
|
install p8022 /bin/disabled-by-security-misc
|
|
install can /bin/disabled-by-security-misc
|
|
install atm /bin/disabled-by-security-misc
|
|
|
|
# Blacklist uncommon file systems to reduce attack surface
|
|
install cramfs /bin/disabled-by-security-misc
|
|
install freevxfs /bin/disabled-by-security-misc
|
|
install jffs2 /bin/disabled-by-security-misc
|
|
install hfs /bin/disabled-by-security-misc
|
|
install hfsplus /bin/disabled-by-security-misc
|
|
install udf /bin/disabled-by-security-misc
|
|
|
|
# Blacklist uncommon network file systems to reduce attack surface
|
|
install cifs /bin/disabled-by-security-misc
|
|
install nfs /bin/disabled-by-security-misc
|
|
install nfsv3 /bin/disabled-by-security-misc
|
|
install nfsv4 /bin/disabled-by-security-misc
|
|
install ksmbd /bin/disabled-by-security-misc
|
|
install gfs2 /bin/disabled-by-security-misc
|
|
|
|
# Blacklists the vivid kernel module as it's only required for testing and has been the cause of multiple vulnerabilities
|
|
# https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598/233
|
|
# https://www.openwall.com/lists/oss-security/2019/11/02/1
|
|
# https://github.com/a13xp0p0v/kconfig-hardened-check/commit/981bd163fa19fccbc5ce5d4182e639d67e484475
|
|
install vivid /bin/disabled-by-security-misc
|
|
|
|
# Blacklist Intel Management Engine (ME) interface with the OS
|
|
# https://www.kernel.org/doc/html/latest/driver-api/mei/mei.html
|
|
install mei /bin/disabled-by-security-misc
|
|
install mei-me /bin/disabled-by-security-misc
|
|
|
|
# Blacklist CD-ROM devices
|
|
# https://nvd.nist.gov/vuln/detail/CVE-2018-11506
|
|
# https://forums.whonix.org/t/blacklist-more-kernel-modules-to-reduce-attack-surface/7989/31
|
|
#install cdrom /bin/disabled-by-security-misc
|
|
#install sr_mod /bin/disabled-by-security-misc
|