Skip to content

Conversation

@donald
Copy link
Collaborator

@donald donald commented May 17, 2026

Requires mariux64/bee-files#3358
Obsoletes #532

Our modified kmod will only allow the modules enumerated in /etc/kmod/whitelist.conf to be loaded. See
mariux64/kmod@v34.2...v34.2-mpi. If the file doesn't exist, any module can be loaded.

Add a initial version of that file from the modules currently loaded on any mx64 system.

If an attempt to load a module which is not in the list is made, a message is sent to syslog:

2026-05-17T14:14:17.088679+02:00 dose  modprobe: kmod whitelist: module 'af_packet' not in whitelist, denied

@donald donald force-pushed the add-kmod-whitelist branch from 6082a87 to b92b04c Compare May 17, 2026 13:00
@donald
Copy link
Collaborator Author

donald commented May 19, 2026

Should we start with a "warn only " mode for a few days?

@donald
Copy link
Collaborator Author

donald commented May 20, 2026

The file now includes whitelist-test-mode. With this, we only log modules, which would have been denied by the whitelist feature. When we keep this for a while, we might get more confidence to enable the normal mode, which actually denies the module loading.

@donald donald mentioned this pull request May 20, 2026
@donald donald merged commit 20d272f into master May 20, 2026
Sign in to join this conversation on GitHub.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant