mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-23 01:23:36 +07:00
Code Issues Packages Projects Releases Wiki Activity

Details on disabled fbdev kernel modules

Browse Source
This commit is contained in:
Raja Grewal 2024-08-07 14:44:14 +10:00
parent e98dc8c4f8
commit a5373afc55
No known key found for this signature in database
GPG Key ID: 92CA473C156B64C4
3 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
README.md
View File

@ -207,7 +207,7 @@ disabling should first be blacklisted for a suitable amount of time.
- FireWire (IEEE 1394): Disabled as they are often vulnerable to DMA attacks. - FireWire (IEEE 1394): Disabled as they are often vulnerable to DMA attacks.
- Framebuffer Drivers: Disabled as they are well-known to be buggy, cause - Framebuffer (fbdev): Disabled as drivers are well-known to be buggy, cause
kernel panics, and are generally only used by legacy devices. kernel panics, and are generally only used by legacy devices.
- GPS: Disable GPS-related modules such as those required for Global Navigation - GPS: Disable GPS-related modules such as those required for Global Navigation

6
etc/modprobe.d/30_security-misc_disable.conf
View File

@ -70,10 +70,12 @@ install raw1394 /usr/bin/disabled-firewire-by-security-misc
install sbp2 /usr/bin/disabled-firewire-by-security-misc install sbp2 /usr/bin/disabled-firewire-by-security-misc
install video1394 /usr/bin/disabled-firewire-by-security-misc install video1394 /usr/bin/disabled-firewire-by-security-misc
## Framebuffer Drivers: ## Framebuffer (fbdev):
## Known to be buggy, cause kernel panics, and are generally only used by legacy devices. ## Video drivers are known to be buggy, cause kernel panics, and are generally only used by legacy devices.
## These were all previously blacklisted. ## These were all previously blacklisted.
## ##
## https://docs.kernel.org/fb/index.html
## https://en.wikipedia.org/wiki/Linux_framebuffer
## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-framebuffer.conf?h=ubuntu/disco ## https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist-framebuffer.conf?h=ubuntu/disco
## ##
install aty128fb /usr/bin/disabled-framebuffer-by-security-misc install aty128fb /usr/bin/disabled-framebuffer-by-security-misc

2
usr/bin/disabled-framebuffer-by-security-misc
View File

@ -5,6 +5,6 @@
## Alerts user that a kernel module failed to load due to it being explicitly disabled by default. ## Alerts user that a kernel module failed to load due to it being explicitly disabled by default.
echo "$0: ALERT: This framebuffer kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2 echo "$0: ALERT: This framebuffer (fbdev) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf for details. | args: $@" >&2
exit 1 exit 1