From ca6e2392e9f16fedcf767a4f97905c4d18cb379b Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Thu, 7 May 2026 22:03:28 +0100 Subject: [PATCH] Add workaround for dirtyfrag vulnerability --- cookbooks/devices/recipes/default.rb | 8 ++++++++ .../devices/templates/default/disable-dirtyfrag.conf.erb | 4 ++++ 2 files changed, 12 insertions(+) create mode 100644 cookbooks/devices/templates/default/disable-dirtyfrag.conf.erb diff --git a/cookbooks/devices/recipes/default.rb b/cookbooks/devices/recipes/default.rb index b06dadfcd..cca90b136 100644 --- a/cookbooks/devices/recipes/default.rb +++ b/cookbooks/devices/recipes/default.rb @@ -51,6 +51,13 @@ template "/etc/modprobe.d/disable-algif.conf" do mode "644" end +template "/etc/modprobe.d/disable-dirtyfrag.conf" do + source "disable-dirtyfrag.conf.erb" + owner "root" + group "root" + mode "644" +end + package "initramfs-tools" execute "update-initramfs" do @@ -58,4 +65,5 @@ execute "update-initramfs" do command "/usr/sbin/update-initramfs -u" subscribes :run, "template[/etc/modprobe.d/nvme.conf]" subscribes :run, "template[/etc/modprobe.d/disable-algif.conf]" + subscribes :run, "template[/etc/modprobe.d/disable-dirtyfrag.conf]" end diff --git a/cookbooks/devices/templates/default/disable-dirtyfrag.conf.erb b/cookbooks/devices/templates/default/disable-dirtyfrag.conf.erb new file mode 100644 index 000000000..bc4d9beb3 --- /dev/null +++ b/cookbooks/devices/templates/default/disable-dirtyfrag.conf.erb @@ -0,0 +1,4 @@ +# DO NOT EDIT - This file is being maintained by Chef +install esp4 /bin/false +install esp6 /bin/false +install rxrpc /bin/false -- 2.39.5