Marc S. Weidner
3ad1726770
Some checks failed
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Failing after 1m11s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
115 lines
3.5 KiB
Bash
115 lines
3.5 KiB
Bash
# SPDX-Version: 3.0
|
|
# SPDX-CreationInfo: 2025-05-05; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.live.builder.git
|
|
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
|
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-FileType: SOURCE
|
|
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
|
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
|
# SPDX-PackageName: CISS.debian.live.builder
|
|
# SPDX-Security-Contact: security@coresecret.eu
|
|
|
|
# The kernel allows unprivileged users to indirectly cause certain modules to be loaded
|
|
# via module auto-loading. This allows an attacker to auto-load a vulnerable module which
|
|
# is then exploited. One such example is CVE-2017-6074, in which an attacker could trigger
|
|
# the DCCP kernel module to be loaded by initiating a DCCP connection and then exploit a
|
|
# vulnerability in said kernel module.
|
|
# Specific kernel modules can be blacklisted by inserting files into /etc/modprobe.d with
|
|
# instructions on which kernel modules to blacklist.
|
|
|
|
##### Disable Uncommon Network Protocols #####
|
|
|
|
install dccp /bin/true
|
|
install sctp /bin/true
|
|
install rds /bin/true
|
|
install tipc /bin/true
|
|
install n-hdlc /bin/true
|
|
install ax25 /bin/true
|
|
install netrom /bin/true
|
|
install x25 /bin/true
|
|
install rose /bin/true
|
|
install decnet /bin/true
|
|
install econet /bin/true
|
|
install af_802154 /bin/true
|
|
install ipx /bin/true
|
|
install appletalk /bin/true
|
|
install psnap /bin/true
|
|
install p8023 /bin/true
|
|
install p8022 /bin/true
|
|
install can /bin/true
|
|
install atm /bin/true
|
|
|
|
# DCCP Datagram Congestion Control Protocol
|
|
# SCTP Stream Control Transmission Protocol
|
|
# RDS Reliable Datagram Sockets
|
|
# TIPC Transparent Inter-process Communication
|
|
# HDLC High-Level Data Link Control
|
|
# AX25 Amateur X.25
|
|
# NetRom
|
|
# X25
|
|
# ROSE
|
|
# DECnet
|
|
# Econet
|
|
# af_802154 IEEE 802.15.4
|
|
# IPX Internetwork Packet Exchange
|
|
# AppleTalk
|
|
# PSNAP Subnetwork Access Protocol
|
|
# p8023 Novell raw IEEE 802.3
|
|
# p8022 IEEE 802.2
|
|
# CAN Controller Area Network
|
|
# ATM
|
|
|
|
##### Disable Uncommon Filesystems #####
|
|
install cramfs /bin/true
|
|
install freevxfs /bin/true
|
|
install jffs2 /bin/true
|
|
install hfs /bin/true
|
|
install hfsplus /bin/true
|
|
install udf /bin/true
|
|
|
|
blacklist cramfs
|
|
blacklist freevxfs
|
|
blacklist jffs2
|
|
blacklist hfs
|
|
blacklist hfsplus
|
|
blacklist udf
|
|
|
|
##### Disable Uncommon Network Filesystems #####
|
|
install cifs /bin/true
|
|
install nfs /bin/true
|
|
install nfsv3 /bin/true
|
|
install nfsv4 /bin/true
|
|
install ksmbd /bin/true
|
|
install gfs2 /bin/true
|
|
|
|
blacklist cifs
|
|
blacklist nfs
|
|
blacklist nfsv3
|
|
blacklist nfsv4
|
|
blacklist ksmbd
|
|
blacklist gfs2
|
|
|
|
# The vivid driver is only useful for testing purposes and has been the cause of privilege escalation vulnerabilities, so it should be disabled.
|
|
install vivid /bin/true
|
|
|
|
##### Disable access to USB #####
|
|
install usb_storage /bin/true
|
|
blacklist usb-storage
|
|
|
|
##### Disable access to IEEE1394 #####
|
|
install firewire-core /bin/true
|
|
|
|
##### Blacklist automatic loading of miscellaneous modules #####
|
|
##### https://git.launchpad.net/ubuntu/+source/kmod/tree/debian/modprobe.d/blacklist.conf?h=ubuntu/disco #####
|
|
# evbug is a debug tool that should be loaded explicitly
|
|
blacklist evbug
|
|
# these drivers are very simple
|
|
blacklist usbmouse
|
|
blacklist usbkbd
|
|
# causes no end of confusion by creating unexpected network interfaces
|
|
blacklist eth1394
|
|
# ugly and loud noise, getting on everyone's nerves
|
|
blacklist pcspkr
|
|
|
|
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|