diff --git a/README.md b/README.md index a515c45..cb65669 100644 --- a/README.md +++ b/README.md @@ -210,6 +210,9 @@ disabling should first be blacklisted for a suitable amount of time. - Not yet enabled: Intel Management Engine (ME): Provides some disabling of the interface between the Intel ME and the OS. See discussion: https://github.com/Kicksecure/security-misc/issues/239 +- Intel Platform Monitoring Technology Telemetry (PMT): Disable some functionality + of the Intel PMT components. + - Network File Systems: Disable uncommon and legacy network file systems. - Network Protocols: Wide array of uncommon and legacy network protocols are disabled. diff --git a/etc/modprobe.d/30_security-misc_disable.conf b/etc/modprobe.d/30_security-misc_disable.conf index 97a8196..426a0e6 100644 --- a/etc/modprobe.d/30_security-misc_disable.conf +++ b/etc/modprobe.d/30_security-misc_disable.conf @@ -103,6 +103,15 @@ install gnss-usb /usr/bin/disabled-gps-by-security-misc #install mei_wdt /usr/bin/disabled-intelme-by-security-misc #install microread_mei /usr/bin/disabled-intelme-by-security-misc +## Intel Platform Monitoring Technology Telemetry (PMT): +## Disable some functionality of the Intel PMT components. +## +## https://github.com/intel/Intel-PMT +## +install pmt_class /usr/bin/disabled-intelpmt-by-security-misc +install pmt_crashlog /usr/bin/disabled-intelpmt-by-security-misc +install pmt_telemetry /usr/bin/disabled-intelpmt-by-security-misc + ## Network File Systems: ## Disable uncommon network file systems to reduce attack surface. ## diff --git a/usr/bin/disabled-intelpmt-by-security-misc b/usr/bin/disabled-intelpmt-by-security-misc new file mode 100755 index 0000000..44f04bc --- /dev/null +++ b/usr/bin/disabled-intelpmt-by-security-misc @@ -0,0 +1,10 @@ +#!/bin/bash + +## Copyright (C) 2024 - 2024 ENCRYPTED SUPPORT LP +## See the file COPYING for copying conditions. + +## Alerts the user that a kernel module failed to load due to it being blacklisted by default. + +echo "$0: ERROR: This Intel Platform Monitoring Technology Telemetry (PMT) kernel module is disabled by package security-misc by default. See the configuration file /etc/modprobe.d/30_security-misc_disable.conf | args: $@" >&2 + +exit 1