Skip to content

Conversation

@donald
Copy link
Collaborator

Requires mariux64/bee-files#3358
Obsoletes #532

Our modified kmod will only allow the modules enumerated in /etc/kmod/whitelist.conf to be loaded. See
mariux64/kmod@v34.2...v34.2-mpi. If the file doesn't exist, any module can be loaded.

Add a initial version of that file from the modules currently loaded on any mx64 system.

If an attempt to load a module which is not in the list is made, a message is sent to syslog:

2026-05-17T14:14:17.088679+02:00 dose  modprobe: kmod whitelist: module 'af_packet' not in whitelist, denied

@donald
Copy link
Collaborator Author

Should we start with a "warn only " mode for a few days?

@donald
Copy link
Collaborator Author

The file now includes whitelist-test-mode. With this, we only log modules, which would have been denied by the whitelist feature. When we keep this for a while, we might get more confidence to enable the normal mode, which actually denies the module loading.

Sign in to join this conversation on GitHub.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant