CIRCLE WITH A DOT

@zekjur Is that something #nixos did from the start? If so, that is hell of a vote of confidence.

@zekjur I do the module block with the install rule; but I think the most elegant is what Debian sysadmin team does: https://salsa.debian.org/dsa-team/mirror/dsa-puppet/-/blob/production/modules/debian_org/templates/rc.local.erb?ref_type=heads/etc/rc.local (which runs at boot if systemd/init hooks it, do check that):sleep 60echo 1 > /proc/sys/kernel/modules_disabledThus after the first minute of boot, disable any further module loading.Works on kernels and for modules that one does not use. Thus Debian is fine, RHEL is not for this class of bugs.(and one can 0 it if need to load a mod)

In case you were wondering: #gokrazy kernels are not vulnerable to copy.fail because they do not include the vulnerable code 🥳In any case, 7.0.3 is available, so maybe update regardless (it’s always good to be up-to-date) If you are not familiar: https://gokrazy.org/ is my Go appliance platform based on the Linux kernel and a 100% Go userspace #Linux #golang