blacklist-rare-network.conf000064400000001107152376665130012016 0ustar00# Many less commonly used network protocols have recently had various
# security flaws discovered. In an effort to reduce the scope of future
# vulnerability exploitations, they are being blacklisted here so that
# unprivileged users cannot use them by default. System owners can still
# either modify this file, or specifically modprobe any needed protocols.

# ax25
alias net-pf-3 off
# netrom
alias net-pf-6 off
# x25
alias net-pf-9 off
# rose
alias net-pf-11 off
# decnet
alias net-pf-12 off
# econet
alias net-pf-19 off
# rds
alias net-pf-21 off
# af_802154
alias net-pf-36 off
disable-algif_aead.conf000064400000000410152376665130011061 0ustar00# Disable algif_aead module due to CVE-2026-31431 (AKA copy.fail)
# This will likely be re-enabled in a subsequent update once an updated
# kernel has been deployed.
# Blacklisting the module isn't sufficient, we need to do as below:
install algif_aead /bin/false
amd64-microcode-blacklist.conf000064400000000232152376665130012251 0ustar00# The microcode module attempts to apply a microcode update when
# it autoloads.  This is not always safe, so we block it by default.
blacklist microcode
iwlwifi.conf000064400000000533152376665130007104 0ustar00# /etc/modprobe.d/iwlwifi.conf
# iwlwifi will dyamically load either iwldvm or iwlmvm depending on the
# microcode file installed on the system.  When removing iwlwifi, first
# remove the iwl?vm module and then iwlwifi.
remove iwlwifi \
(/sbin/lsmod | grep -o -e ^iwlmvm -e ^iwldvm -e ^iwlwifi | xargs /sbin/rmmod) \
&& /sbin/modprobe -r mac80211
intel-microcode-blacklist.conf000064400000000232152376665130012451 0ustar00# The microcode module attempts to apply a microcode update when
# it autoloads.  This is not always safe, so we block it by default.
blacklist microcode
mdadm.conf000064400000000573152376665130006520 0ustar00# mdadm module configuration file
# set start_ro=1 to make newly assembled arrays read-only initially,
# to prevent metadata writes.  This is needed in order to allow
# resume-from-disk to work - new boot should not perform writes
# because it will be done behind the back of the system being
# resumed.  See http://bugs.debian.org/415441 for details.

options md_mod start_ro=1
blacklist-firewire.conf000064400000000322152376665130011210 0ustar00# Select the legacy firewire stack over the new CONFIG_FIREWIRE one.

blacklist ohci1394
blacklist sbp2
blacklist dv1394
blacklist raw1394
blacklist video1394

#blacklist firewire-ohci
#blacklist firewire-sbp2
blacklist.conf000064400000002756152376665130007413 0ustar00# This file lists those modules which we don't want to be loaded by
# alias expansion, usually so some other driver will be loaded for the
# device instead.

# evbug is a debug tool that should be loaded explicitly
blacklist evbug

# these drivers are very simple, the HID drivers are usually preferred
blacklist usbmouse
blacklist usbkbd

# replaced by e100
blacklist eepro100

# replaced by tulip
blacklist de4x5

# causes no end of confusion by creating unexpected network interfaces
blacklist eth1394

# snd_intel8x0m can interfere with snd_intel8x0, doesn't seem to support much
# hardware on its own (Ubuntu bug #2011, #6810)
blacklist snd_intel8x0m

# Conflicts with dvb driver (which is better for handling this device)
blacklist snd_aw2

# replaced by p54pci
blacklist prism54

# replaced by b43 and ssb.
blacklist bcm43xx

# most apps now use garmin usb driver directly (Ubuntu: #114565)
blacklist garmin_gps

# replaced by asus-laptop (Ubuntu: #184721)
blacklist asus_acpi

# low-quality, just noise when being used for sound playback, causes
# hangs at desktop session start (Ubuntu: #246969)
blacklist snd_pcsp

# ugly and loud noise, getting on everyone's nerves; this should be done by a
# nice pulseaudio bing (Ubuntu: #77010)
blacklist pcspkr

# EDAC driver for amd76x clashes with the agp driver preventing the aperture
# from being initialised (Ubuntu: #297750). Blacklist so that the driver
# continues to build and is installable for the few cases where its
# really needed.
blacklist amd76x_edac
blacklist-framebuffer.conf000064400000001245152376665130011665 0ustar00# Framebuffer drivers are generally buggy and poorly-supported, and cause
# suspend failures, kernel panics and general mayhem.  For this reason we
# never load them automatically.
blacklist aty128fb
blacklist atyfb
blacklist radeonfb
blacklist cirrusfb
blacklist cyber2000fb
blacklist cyblafb
blacklist gx1fb
blacklist hgafb
blacklist i810fb
blacklist intelfb
blacklist kyrofb
blacklist lxfb
blacklist matroxfb_base
blacklist neofb
blacklist nvidiafb
blacklist pm2fb
blacklist rivafb
blacklist s1d13xxxfb
blacklist savagefb
blacklist sisfb
blacklist sstfb
blacklist tdfxfb
blacklist tridentfb
#blacklist vesafb
blacklist vfb
blacklist viafb
blacklist vt8623fb
blacklist udlfb
blacklist-ath_pci.conf000064400000000505152376665130011006 0ustar00# For some Atheros 5K RF MACs, the madwifi driver loads buts fails to
# correctly initialize the hardware, leaving it in a state from
# which ath5k cannot recover. To prevent this condition, stop
# madwifi from loading by default. Use Jockey to select one driver
# or the other. (Ubuntu: #315056, #323830)
blacklist ath_pci

aliases.conf000064400000001160152401317230007030 0ustar00# These are the standard aliases and dependencies.
# This file does not need to be modified.

# prevent unusual drivers from appearing as the first sound device ###########
options snd-pcsp index=-2
options cx88_alsa index=-2
options snd-atiixp-modem index=-2
options snd-intel8x0m index=-2
options snd-via82xx-modem index=-2

# work around other kernel issues ############################################
# The EHCI driver should be loaded before the ones for low speed controllers
# or some devices may be confused when they are disconnected and reconnected.
softdep uhci-hcd pre: ehci-hcd
softdep ohci-hcd pre: ehci-hcd

blacklist_linux_6.8.0-117-generic.conf000064400000003117152401317230013253 0ustar00# Kernel supplied blacklist for linux 6.8.0-117-generic amd64
# modprobe.d/common.conf
# LP:1434842 -- disable OSS drivers by default to allow pulseaudio to emulate
blacklist snd-mixer-oss
blacklist snd-pcm-oss
# Autogenerated watchdog blacklist
blacklist acquirewdt
blacklist advantech_ec_wdt
blacklist advantechwdt
blacklist alim1535_wdt
blacklist alim7101_wdt
blacklist cadence_wdt
blacklist cpu5wdt
blacklist da9052_wdt
blacklist da9055_wdt
blacklist da9062_wdt
blacklist da9063_wdt
blacklist dw_wdt
blacklist ebc-c384_wdt
blacklist eurotechwdt
blacklist exar_wdt
blacklist f71808e_wdt
blacklist hpwdt
blacklist i6300esb
blacklist iTCO_vendor_support
blacklist iTCO_wdt
blacklist ib700wdt
blacklist ibmasr
blacklist ie6xx_wdt
blacklist it8712f_wdt
blacklist it87_wdt
blacklist kempld_wdt
blacklist machzwd
blacklist max63xx_wdt
blacklist mei_wdt
blacklist mena21_wdt
blacklist menf21bmc_wdt
blacklist menz69_wdt
blacklist mlx_wdt
blacklist ni903x_wdt
blacklist nic7018_wdt
blacklist nv_tco
blacklist of_xilinx_wdt
blacklist pc87413_wdt
blacklist pcwd_pci
blacklist pcwd_usb
blacklist pretimeout_panic
blacklist rave-sp-wdt
blacklist retu_wdt
blacklist sbc60xxwdt
blacklist sbc_epx_c3
blacklist sbc_fitpc2_wdt
blacklist sc1200wdt
blacklist sch311x_wdt
blacklist simatic-ipc-wdt
blacklist smsc37b787_wdt
blacklist softdog
blacklist sp5100_tco
blacklist tqmx86_wdt
blacklist twl4030_wdt
blacklist via_wdt
blacklist w83627hf_wdt
blacklist w83877f_wdt
blacklist w83977f_wdt
blacklist wafer5823wdt
blacklist wdat_wdt
blacklist wdt_pci
blacklist wm831x_wdt
blacklist wm8350_wdt
blacklist xen_wdt
blacklist ziirave_wdt
fbdev-blacklist.conf000064400000000606152401317230010447 0ustar00# This file blacklists most old-style PCI framebuffer drivers.

blacklist arkfb
blacklist aty128fb
blacklist atyfb
blacklist radeonfb
blacklist cirrusfb
blacklist cyber2000fb
blacklist kyrofb
blacklist matroxfb_base
blacklist mb862xxfb
blacklist neofb
blacklist pm2fb
blacklist pm3fb
blacklist s3fb
blacklist savagefb
blacklist sisfb
blacklist tdfxfb
blacklist tridentfb
blacklist vt8623fb
systemd.conf000064400000001465152401317230007107 0ustar00#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.
#
# When bonding module is loaded, it creates bond0 by default due to max_bonds
# option default value 1. This interferes with the network configuration
# management / networkd, as it is not possible to detect whether this bond0 was
# intentionally configured by the user, or should be managed by
# networkd/NM/etc. Therefore disable bond0 creation.

options bonding max_bonds=0

# Do the same for dummy0.

options dummy numdummies=0

# Do the same for ifb0.

options ifb numifbs=0
blacklist_linux_6.8.0-111-generic.conf000064400000003117152401317230013245 0ustar00# Kernel supplied blacklist for linux 6.8.0-111-generic amd64
# modprobe.d/common.conf
# LP:1434842 -- disable OSS drivers by default to allow pulseaudio to emulate
blacklist snd-mixer-oss
blacklist snd-pcm-oss
# Autogenerated watchdog blacklist
blacklist acquirewdt
blacklist advantech_ec_wdt
blacklist advantechwdt
blacklist alim1535_wdt
blacklist alim7101_wdt
blacklist cadence_wdt
blacklist cpu5wdt
blacklist da9052_wdt
blacklist da9055_wdt
blacklist da9062_wdt
blacklist da9063_wdt
blacklist dw_wdt
blacklist ebc-c384_wdt
blacklist eurotechwdt
blacklist exar_wdt
blacklist f71808e_wdt
blacklist hpwdt
blacklist i6300esb
blacklist iTCO_vendor_support
blacklist iTCO_wdt
blacklist ib700wdt
blacklist ibmasr
blacklist ie6xx_wdt
blacklist it8712f_wdt
blacklist it87_wdt
blacklist kempld_wdt
blacklist machzwd
blacklist max63xx_wdt
blacklist mei_wdt
blacklist mena21_wdt
blacklist menf21bmc_wdt
blacklist menz69_wdt
blacklist mlx_wdt
blacklist ni903x_wdt
blacklist nic7018_wdt
blacklist nv_tco
blacklist of_xilinx_wdt
blacklist pc87413_wdt
blacklist pcwd_pci
blacklist pcwd_usb
blacklist pretimeout_panic
blacklist rave-sp-wdt
blacklist retu_wdt
blacklist sbc60xxwdt
blacklist sbc_epx_c3
blacklist sbc_fitpc2_wdt
blacklist sc1200wdt
blacklist sch311x_wdt
blacklist simatic-ipc-wdt
blacklist smsc37b787_wdt
blacklist softdog
blacklist sp5100_tco
blacklist tqmx86_wdt
blacklist twl4030_wdt
blacklist via_wdt
blacklist w83627hf_wdt
blacklist w83877f_wdt
blacklist w83977f_wdt
blacklist wafer5823wdt
blacklist wdat_wdt
blacklist wdt_pci
blacklist wm831x_wdt
blacklist wm8350_wdt
blacklist xen_wdt
blacklist ziirave_wdt