oss-sec mailing list archives

Re: Recent Kernel exploits, attack surface reduction, example IPSEC

From: Agostino Sarubbo <ago () gentoo org>
Date: Sat, 16 May 2026 19:15:07 +0200

On sabato 16 maggio 2026 15:05:45 Ora legale dell’Europa centrale Hanno 
Böck wrote:

To pick the example of IPSEC, i wonder if it wouldn't be better to
have, e.g., a separate "linux-modules-ipsec" package that isn't
installed by default. People who use and need IPSEC will likely know
that they need it, and can install it separately.


Hello Hanno,

I understand your rationale. To reduce the "complexity" of your proposal, 
those modules can be configured as modules (I mean CONFIG_[snip]=m) 
and blacklisted by default in /etc/modprobe.d/
What do you think?

Current thread:

Recent Kernel exploits, attack surface reduction, example IPSEC Hanno Böck (May 16)
- Re: Recent Kernel exploits, attack surface reduction, example IPSEC Valtteri Vuorikoski (May 16)
- Re: Recent Kernel exploits, attack surface reduction, example IPSEC Agostino Sarubbo (May 16)
- Re: Recent Kernel exploits, attack surface reduction, example IPSEC Bernhard R. Link (May 16)
  - Re: Recent Kernel exploits, attack surface reduction, example IPSEC Donald Buczek (May 17)
- Re: Recent Kernel exploits, attack surface reduction, example IPSEC Lionel Debroux (May 16)
- Re: Recent Kernel exploits, attack surface reduction, example IPSEC Jeffrey Walton (May 16)