Block the test video driver
The vivid driver exists only for testing and has caused privilege escalation flaws.
Why it matters
The vivid driver creates fake video devices for testing video software, and it has no use on a normal computer. Bugs in it have allowed privilege escalation in the past. If it is not loaded, those bugs cannot be used. Since it is usually not loaded anyway, the gain is small but the cost is zero.
How it works
Adds a modprobe configuration that blocks loading the vivid module. Any attempt to load it, by an administrator or by an attacker who can run modprobe, then fails.
Who should use it
Everyone except developers who test video capture or camera software with virtual devices and need vivid.
What you may notice
Nothing for normal users. A developer who tries to load vivid sees modprobe fail, and no virtual test cameras appear.
Check it on your computer
See whether the modules are loaded:
lsmod | grep -E '^(vivid) 'Apply it by hand
Tell the system not to load them, in a file you own:
sudo tee /etc/modprobe.d/90-modules-vivid.conf <<'EOF'
install vivid /bin/false
EOFUndo it
Remove the file. Modules already loaded stay until the next restart.
Related settings
Sources
- Linux Hardening Guide (madaidans)
- 2.5.2