[Bug 295485] need a way to block zfs.ko from being autoloaded by tools like puppet and facter

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=295485

Shawn Webb <[email protected]> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[email protected]

--- Comment #1 from Shawn Webb <[email protected]> ---
HardenedBSD has a nifty feature to disable loading of kernel modules entirely,
governed by a sysctl node: hardening.pax.kmod_load_disable. The node supports
the following values:

0: Permit kernel module loading
1: Prohibit kernel module unloading
2: Prohibit kernel module unloading, and require a reboot to modify this sysctl
node further

We have integrated that sysctl node into the kld rc script, so a user could set
hbsd_late_kld_prohibit to YES in rc.conf. This will set
hardening.pax.kmod_load_disable to 1 after all desired kernel modules have been
loaded (eg, after loading what's listed in the kld_list rc.conf variable).

HardenedBSD also has a method of tagging individual kernel modules as
"insecure/untrusted" and ships with a few kernel modules in base with that
enabled. In order to load an untrusted kld module, a user must first explicitly
tell the OS to trust that kernel module (hbsdcontrol pax disable insecure_kmod
/path/to/kernel/module.ko).

I don't know what Allan has come up with, but this seems to be sufficient for
HardenedBSD's users. It could serve as inspiration for whatever FreeBSD might
come up with.

-- 
You are receiving this mail because:
You are the assignee for the bug.