80-block-network 1.53 KB
Newer Older
1
2
3
4
#!/bin/sh

set -e

5
echo "Generating blocklist for all network devices"
6

boyska's avatar
boyska committed
7
is_allowed() {
8
9
    mod="$(basename "$1" .ko)"
    shift
boyska's avatar
boyska committed
10
    # the heredoc is the allowlist
11
12
13
14
15
    grep -qwF "$mod" <<END
veth
END
}

16
17
is_net_module() {
    # Here we assume that if any of the patterns below are matched, it
intrigeri's avatar
intrigeri committed
18
    # is a network driver. This is not comprehensive, but should be
19
20
21
22
23
24
25
26
27
    # enough for the staging directory (worst case we blacklist some
    # shitty non-network driver by mistake).
    /sbin/modinfo "${1}" | \
        grep -q --extended-regexp \
             -e "^depends:\s*(cfg|lib|mac)80211" \
             -e "^parm:\s*ifname:"
}
net_module_filter() {
    local path
intrigeri's avatar
intrigeri committed
28
    while read -r path; do
boyska's avatar
boyska committed
29
        if ! is_allowed "${path}" && is_net_module "${path}"; then
30
31
32
33
            echo "${path}"
        fi
    done
}
boyska's avatar
boyska committed
34
remove_allowlist_filter() {
35
    local path
36
    while read -r path; do
boyska's avatar
boyska committed
37
        if ! is_allowed "${path}"; then
38
            echo "${path}"
39
40
41
42
        fi
    done
}

43
44
45
generate_blocking_line() {
    local name
    local path
intrigeri's avatar
intrigeri committed
46
    while read -r path; do
anonym's avatar
anonym committed
47
        name="$(basename "${path}" .ko)"
intrigeri's avatar
intrigeri committed
48
        printf "install %s /bin/true\n" "${name}"
49
50
51
    done
}

52
53
BLACKLIST=/etc/modprobe.d/all-net-blacklist.conf

54
55
(
    find /lib/modules/*/kernel/drivers/net -name "*.ko" | \
boyska's avatar
boyska committed
56
        remove_allowlist_filter | \
57
58
        generate_blocking_line && \

intrigeri's avatar
intrigeri committed
59
    # Let's try to find the network drivers in the staging directory as well
60
61
62
63
    find /lib/modules/*/kernel/drivers/staging/ -name "*.ko" | \
        net_module_filter | \
        generate_blocking_line
) | sort -u > "${BLACKLIST}"