Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

disable uncommon filesystems and network protocols #2255

Merged
merged 2 commits into from
Jul 7, 2022
Merged

disable uncommon filesystems and network protocols #2255

merged 2 commits into from
Jul 7, 2022

Commits on Jul 7, 2022

  1. kernel: disable unused filesystems 

    It's not possible to rule out the existence of workloads using these
filesystems, but it is possible to make a series of educated guesses.

For Kubernetes variants, a CSI driver that supports the filesystem
would be required to use it for container storage. This is especially
true for network-based fileystems, because Bottlerocket does not ship
any of the userspace tools required.

Disabled network filesystems:
* afs - network-based, no CSI driver
* gfs2 - network-based, no CSI driver
* nfs v2 - obsoleted by later versions of NFS

Another use case would be containers that run with CAP_SYS_ADMIN and
mount full disk or filesystem images. Disabling these filesystems is
more of a judgment call, and comes down to whether the format is
obsolete, whether it's in common use, whether it's useful on current
platforms, and if it's consistently enabled across architectures.

Obsolete local filesystems:
* cramfs - read-only format, obsoleted by squashfs
* ecryptfs - obsoleted by native filesystem encryption
* ext2 - obsolete, handled by the ext4 driver
* ext3 - obsolete, handled by the ext4 driver
* romfs - obsoleted by initramfs

Uncommon local filesystems:
* hfs, hfsplus - not enabled on aarch64
* jfs - not enabled on aarch64
* jffs2 - not supported by current platforms
* nilfs2 - not enabled on aarch64
* ntfs - not enabled on 5.10 kernels
* ufs - not enabled on aarch64
* zonefs - not supported by current platforms

Note that a potential use case for hfsplus could be to generate DMG
files for OS X software installs. However, the more common approach
appears to be using `genisoimage` on Linux.

Signed-off-by: Ben Cressey <[email protected]>
    @bcressey
    bcressey committed Jul 7, 2022
    Configuration menu
    Copy the full SHA
    61392f7 View commit details
    Browse the repository at this point in the history

  2. kernel: disable unused network protocols 

    These protocols are unlikely to be used. They might require special
hardware; they might just not be supported on the platforms where
Bottlerocket runs today; they might raise security concerns; or some
other reasoning might apply.

Requires special hardware or platform support:
* atm - an alternative to IP
* can - used in automative and industrial applications
* hsr - redundancy protocol for wired networks
* rfkill - controls RF switches on WiFi and Bluetooth cards

Raises security concerns:
* dccp - CVE-2020-16119, CVE-2018-1130
* rds - CVE-2021-45480, CVE-2019-11815
* tipc - CVE-2022-0435, CVE-2021-29646

Other reasons:
* af-rxrpc - only used by AFS, which is disabled
* l2tp - not enabled in 5.10 for x86_64

Signed-off-by: Ben Cressey <[email protected]>
    @bcressey
    bcressey committed Jul 7, 2022
    Configuration menu
    Copy the full SHA
    dfe344d View commit details
    Browse the repository at this point in the history