Copy Fail 2 - Electric Boogaloo [LWN.net]

Copy Fail 2 - Electric Boogaloo

Posted May 8, 2026 12:10 UTC (Fri) by hmh (subscriber, #3838)
In reply to: Copy Fail 2 - Electric Boogaloo by wtarreau
Parent article: Dirty Frag: a zero-day universal Linux LPE

Well, there is:

echo 1 > /proc/sys/kernel/modules_disabled

Which is supposed to be an one-way trapdoor, and require a reboot / kexec, or perhaps a kernel-level write exploit to undo.

Although the usability of that functionality is quite bad, it would have been effective against both copy.fail variants and dirtyflag on the servers here, since our servers have very static module-load needs and we could just populate a load-these-modules-on-initramfs list, and then kick the module-loading trapdoor shut if we wanted to...

to post comments

Copy Fail 2 - Electric Boogaloo

Posted May 8, 2026 19:14 UTC (Fri) by MarcB (subscriber, #101804) [Link] (5 responses)

We are currently trying this, via a late Systemd unit. There were some gotchas: lazy/optionally auto-mounted NFS, BMC hardware, ... But is seems to be a viable approach, at least for the many, very uniform and static (kernel-wise) systems we run.

Copy Fail 2 - Electric Boogaloo

Posted May 8, 2026 19:42 UTC (Fri) by sf (subscriber, #46625) [Link] (4 responses)

I use a wrapper for modprobe that implements a whitelist and that I put into /proc/sys/kernel/modprobe . This has the advantage that the whitelist can be added to without reboot and more importantly, the wrapper logs all blocked attempts to load a module which is important for debugging. Without module autoloading, things can fail in quite surprising ways.

Copy Fail 2 - Electric Boogaloo

Posted May 9, 2026 5:08 UTC (Sat) by wtarreau (subscriber, #51152) [Link] (2 responses)

> use a wrapper for modprobe that implements a whitelist and that I put into /proc/sys/kernel/modprobe .

Yeah that's much more what I'm seeking in fact. There is value in sharing this, you know ? It may be popular these days :-)

Copy Fail 2 - Electric Boogaloo

Posted May 9, 2026 7:56 UTC (Sat) by sf (subscriber, #46625) [Link] (1 responses)

It is very simplistic. I have written a short readme and published it at https://github.com/s-fritsch/modprobe-wrapper

Copy Fail 2 - Electric Boogaloo

Posted May 9, 2026 9:24 UTC (Sat) by wtarreau (subscriber, #51152) [Link]

> It is very simplistic. I have written a short readme and published it at https://github.com/s-fritsch/modprobe-wrapper

Clean, simple and effective. Thank you for sharing!

Copy Fail 2 - Electric Boogaloo

Posted May 9, 2026 6:31 UTC (Sat) by pabs (subscriber, #43278) [Link]

Seems like modprobe itself should have that sort of functionality. Probably wouldn't be hard to add either, let the module blocking command accept 'all' or '*' as an argument, then add an allow command to undo that partially.