Whitelist support

[sathieu]

Several recent Kernel vulnerabilities (like Copy Fail, Dirty Frag, Fragnesia, ...) can be mitigated by blacklisting kernel modules.

It would be great to be able to whitelist modules instead of blacklisting.

This was already proposed in Fedora in 2010, see links below, including a patch.

Prior art:

• https://fedoraproject.org/wiki/Features/ModprobeWhitelist
• https://bugzilla.redhat.com/show_bug.cgi?id=560084
• https://bugzilla.redhat.com/attachment.cgi?id=638907

[evelikov]

Generally, I would be in favour of the idea... Even though it does sound a bit like a footgut, if used by untrained hands. As with many open-source projects - patches/PR welcome.

Just a friendly note that kmod has gained support for weak and soft dependencies, since the proposal/patch was written. So the updated patch(es) should clearly outline how they are handled and why.