Copy Fail 2 - Electric Boogaloo [LWN.net]

Copy Fail 2 - Electric Boogaloo

Posted May 8, 2026 19:14 UTC (Fri) by MarcB (subscriber, #101804)
In reply to: Copy Fail 2 - Electric Boogaloo by hmh
Parent article: Dirty Frag: a zero-day universal Linux LPE

We are currently trying this, via a late Systemd unit. There were some gotchas: lazy/optionally auto-mounted NFS, BMC hardware, ... But is seems to be a viable approach, at least for the many, very uniform and static (kernel-wise) systems we run.

to post comments

Copy Fail 2 - Electric Boogaloo

Posted May 8, 2026 19:42 UTC (Fri) by sf (subscriber, #46625) [Link] (4 responses)

I use a wrapper for modprobe that implements a whitelist and that I put into /proc/sys/kernel/modprobe . This has the advantage that the whitelist can be added to without reboot and more importantly, the wrapper logs all blocked attempts to load a module which is important for debugging. Without module autoloading, things can fail in quite surprising ways.

Copy Fail 2 - Electric Boogaloo

Posted May 9, 2026 5:08 UTC (Sat) by wtarreau (subscriber, #51152) [Link] (2 responses)

> use a wrapper for modprobe that implements a whitelist and that I put into /proc/sys/kernel/modprobe .

Yeah that's much more what I'm seeking in fact. There is value in sharing this, you know ? It may be popular these days :-)

Copy Fail 2 - Electric Boogaloo

Posted May 9, 2026 7:56 UTC (Sat) by sf (subscriber, #46625) [Link] (1 responses)

It is very simplistic. I have written a short readme and published it at https://github.com/s-fritsch/modprobe-wrapper

Copy Fail 2 - Electric Boogaloo

Posted May 9, 2026 9:24 UTC (Sat) by wtarreau (subscriber, #51152) [Link]

> It is very simplistic. I have written a short readme and published it at https://github.com/s-fritsch/modprobe-wrapper

Clean, simple and effective. Thank you for sharing!

Copy Fail 2 - Electric Boogaloo

Posted May 9, 2026 6:31 UTC (Sat) by pabs (subscriber, #43278) [Link]

Seems like modprobe itself should have that sort of functionality. Probably wouldn't be hard to add either, let the module blocking command accept 'all' or '*' as an argument, then add an allow command to undo that partially.