| 1 |
# Alloy module policy: modules nothing here loads cannot be loaded. |
| 2 |
# |
| 3 |
# `install <mod> /bin/false` RATHER THAN `blacklist <mod>`, and the difference |
| 4 |
# is the whole point. `blacklist` only stops autoloading — a direct |
| 5 |
# `modprobe cramfs` still succeeds, and so does anything that triggers module |
| 6 |
# autoload through an alias. `install` replaces the load command, so both |
| 7 |
# paths fail. A file full of `blacklist` lines looks like protection and is |
| 8 |
# mostly a preference. |
| 9 |
# |
| 10 |
# The rule for what belongs here: it must be a module this image has no caller |
| 11 |
# for. Anything the ISO, the installer, podman, flatpak or the desktop touches |
| 12 |
# stays loadable. See wiki `alloy-hardening-posture`. |
| 13 |
|
| 14 |
# --------------------------------------------------------------------- |
| 15 |
# Filesystems nothing here mounts |
| 16 |
# --------------------------------------------------------------------- |
| 17 |
# |
| 18 |
# Old filesystem drivers are a recurring source of memory-corruption bugs |
| 19 |
# reachable from a plugged-in USB stick, since the kernel autoloads a driver |
| 20 |
# to match whatever superblock it finds. |
| 21 |
install cramfs /bin/false |
| 22 |
install freevxfs /bin/false |
| 23 |
install jffs2 /bin/false |
| 24 |
install hfs /bin/false |
| 25 |
install hfsplus /bin/false |
| 26 |
# udf: checked against build/make-iso.sh before landing here. The installer |
| 27 |
# ISO is iso9660 with Rock Ridge — xorriso is called with no `-udf` — so the |
| 28 |
# live medium does not need this driver to mount itself. GRUB's own udf module |
| 29 |
# in that script is firmware-side and unrelated. |
| 30 |
install udf /bin/false |
| 31 |
install ksmbd /bin/false |
| 32 |
|
| 33 |
# NOT BLACKLISTED: squashfs, and this line is why the file says to measure |
| 34 |
# first. The installer ISO boots a live root out of a squashfs |
| 35 |
# (build/make-iso.sh, dracut-live), so blacklisting it produces a medium that |
| 36 |
# cannot boot itself — and the failure appears at install time on someone |
| 37 |
# else's machine, not here. |
| 38 |
# |
| 39 |
# NOT BLACKLISTED: overlay, fuse, ext4, xfs, vfat, exfat, ntfs3. podman and |
| 40 |
# flatpak need the first two, bootc installs onto xfs, the ESP is vfat, and |
| 41 |
# `alloy disk` exists to mount other people's removable media. |
| 42 |
|
| 43 |
# --------------------------------------------------------------------- |
| 44 |
# Network protocols nothing here speaks |
| 45 |
# --------------------------------------------------------------------- |
| 46 |
install dccp /bin/false |
| 47 |
install sctp /bin/false |
| 48 |
install rds /bin/false |
| 49 |
install tipc /bin/false |
| 50 |
install n-hdlc /bin/false |
| 51 |
install ax25 /bin/false |
| 52 |
install netrom /bin/false |
| 53 |
install rose /bin/false |
| 54 |
install decnet /bin/false |
| 55 |
install econet /bin/false |
| 56 |
install af_802154 /bin/false |
| 57 |
install ipx /bin/false |
| 58 |
install appletalk /bin/false |
| 59 |
install psnap /bin/false |
| 60 |
install p8023 /bin/false |
| 61 |
install p8022 /bin/false |
| 62 |
install can /bin/false |
| 63 |
install atm /bin/false |
| 64 |
|
| 65 |
# --------------------------------------------------------------------- |
| 66 |
# DMA over a cable |
| 67 |
# --------------------------------------------------------------------- |
| 68 |
# |
| 69 |
# FireWire gives anything plugged into the port direct memory access. No |
| 70 |
# machine Alloy targets has a FireWire port; the driver being loadable is the |
| 71 |
# only reason this matters at all. |
| 72 |
install firewire-core /bin/false |
| 73 |
install firewire-ohci /bin/false |
| 74 |
install firewire-sbp2 /bin/false |
| 75 |
install ohci1394 /bin/false |
| 76 |
install sbp2 /bin/false |
| 77 |
install dv1394 /bin/false |
| 78 |
install raw1394 /bin/false |
| 79 |
install video1394 /bin/false |
| 80 |
|
| 81 |
# NOT BLACKLISTED: thunderbolt. It carries the same DMA risk and it is also |
| 82 |
# how a Framework's dock, display and external storage work. The answer there |
| 83 |
# is IOMMU and device authorization (the `alloy usb` work), not refusing to |
| 84 |
# load the driver. |
| 85 |
|
| 86 |
# --------------------------------------------------------------------- |
| 87 |
# Removed at the source instead |
| 88 |
# --------------------------------------------------------------------- |
| 89 |
# |
| 90 |
# Uncommon USB and Bluetooth drivers are not listed. USB device policy belongs |
| 91 |
# to `alloy usb` rather than to a list of module names that goes stale, and |
| 92 |
# Bluetooth is a shipped feature (see 50-alloy.preset). |
| 93 |
|