]> git.ipfire.org Git - ipfire-2.x.git/commit
sysctl.conf: prevent autoloading of TTY line disciplines
authorPeter Müller <peter.mueller@ipfire.org>
Mon, 5 Oct 2020 19:45:31 +0000 (19:45 +0000)
committerMichael Tremer <michael.tremer@ipfire.org>
Tue, 6 Oct 2020 12:04:14 +0000 (12:04 +0000)
commit14c65ab71ccbe3b0810ac6986d6ad02486f9f9a4
tree8fc615d09aaecff8af6c4129ba020cb1be1b306a
parent6ec99a3372a7e6a0735bad9de53277a9157d8951
sysctl.conf: prevent autoloading of TTY line disciplines

Malicious/vulnerable TTY line disciplines have been subject of some
kernel exploits such as CVE-2017-2636, and since - to put it in Greg
Kroah-Hatrman's words - we do not "trust the userspace to do the right
thing", this reduces local kernel attack surface.

Further, there is no legitimate reason why an unprivileged user should
load kernel modules during runtime, anyway.

See also:
- https://lkml.org/lkml/2019/4/15/890
- https://a13xp0p0v.github.io/2017/03/24/CVE-2017-2636.html

Cc: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
config/etc/sysctl.conf