search

lkrg-org / lkrg

Linux Kernel Runtime Guard
https://lkrg.org
Other
402 stars 72 forks source link

UMH: Optionally block distros' core dump analysis programs #246

Open solardiz opened 1 year ago

solardiz commented 1 year ago

We're currently (after #245) allow-listing these UMH program pathnames:

   "/lib/systemd/systemd-coredump",
   "/usr/lib/systemd/systemd-coredump",
   "/usr/libexec/abrt-hook-ccpp",
   "/usr/share/apport/apport",

This is dangerous non-essential functionality of those distros, which we could want to have LKRG optionally block - so maybe split them out into a separate optional allow list later.