Copy Fail 2 - Electric Boogaloo [LWN.net]

Copy Fail 2 - Electric Boogaloo

Posted May 8, 2026 11:40 UTC (Fri) by wtarreau (subscriber, #51152)
In reply to: Copy Fail 2 - Electric Boogaloo by cortana
Parent article: Dirty Frag: a zero-day universal Linux LPE

I disable a these as well as a number of other ones. Basically all unneeded network protocols and filesystems. One can find /lib/modules* -name '*.ko*' then compare with lsmod and add rules to block all unneeded ones. Ideally I'd like to have a principle of denying all modules and only allowing a few select ones (i.e. the ones I find via lsmod).

to post comments

Copy Fail 2 - Electric Boogaloo

Posted May 8, 2026 11:54 UTC (Fri) by smcv (subscriber, #53363) [Link] (1 responses)

I think the way to do that is to load all your required modules, and then echo 1 > /proc/sys/kernel/modules_disabled to prevent any other module from being loaded until the next reboot.

Copy Fail 2 - Electric Boogaloo

Posted May 9, 2026 5:06 UTC (Sat) by wtarreau (subscriber, #51152) [Link]

> echo 1 > /proc/sys/kernel/modules_disabled

It's not exactly the same. I'm fine with root modifying the list if needed (e.g. trying to mount an FS that's not loaded). Here it's no longer possible.

Copy Fail 2 - Electric Boogaloo

Posted May 8, 2026 12:10 UTC (Fri) by hmh (subscriber, #3838) [Link] (6 responses)

Well, there is:

echo 1 > /proc/sys/kernel/modules_disabled

Which is supposed to be an one-way trapdoor, and require a reboot / kexec, or perhaps a kernel-level write exploit to undo.

Although the usability of that functionality is quite bad, it would have been effective against both copy.fail variants and dirtyflag on the servers here, since our servers have very static module-load needs and we could just populate a load-these-modules-on-initramfs list, and then kick the module-loading trapdoor shut if we wanted to...

Copy Fail 2 - Electric Boogaloo

Posted May 8, 2026 19:14 UTC (Fri) by MarcB (subscriber, #101804) [Link] (5 responses)

We are currently trying this, via a late Systemd unit. There were some gotchas: lazy/optionally auto-mounted NFS, BMC hardware, ... But is seems to be a viable approach, at least for the many, very uniform and static (kernel-wise) systems we run.

Copy Fail 2 - Electric Boogaloo

Posted May 8, 2026 19:42 UTC (Fri) by sf (subscriber, #46625) [Link] (4 responses)

I use a wrapper for modprobe that implements a whitelist and that I put into /proc/sys/kernel/modprobe . This has the advantage that the whitelist can be added to without reboot and more importantly, the wrapper logs all blocked attempts to load a module which is important for debugging. Without module autoloading, things can fail in quite surprising ways.

Copy Fail 2 - Electric Boogaloo

Posted May 9, 2026 5:08 UTC (Sat) by wtarreau (subscriber, #51152) [Link] (2 responses)

> use a wrapper for modprobe that implements a whitelist and that I put into /proc/sys/kernel/modprobe .

Yeah that's much more what I'm seeking in fact. There is value in sharing this, you know ? It may be popular these days :-)

Copy Fail 2 - Electric Boogaloo

Posted May 9, 2026 7:56 UTC (Sat) by sf (subscriber, #46625) [Link] (1 responses)

It is very simplistic. I have written a short readme and published it at https://github.com/s-fritsch/modprobe-wrapper

Copy Fail 2 - Electric Boogaloo

Posted May 9, 2026 9:24 UTC (Sat) by wtarreau (subscriber, #51152) [Link]

> It is very simplistic. I have written a short readme and published it at https://github.com/s-fritsch/modprobe-wrapper

Clean, simple and effective. Thank you for sharing!

Copy Fail 2 - Electric Boogaloo

Posted May 9, 2026 6:31 UTC (Sat) by pabs (subscriber, #43278) [Link]

Seems like modprobe itself should have that sort of functionality. Probably wouldn't be hard to add either, let the module blocking command accept 'all' or '*' as an argument, then add an allow command to undo that partially.