Do not load terminal line disciplines on demand

Why it matters

A TTY line discipline is a piece of kernel code that handles data on a serial-style terminal. Some old ones had flaws, and an ordinary program could ask the kernel to load them with the TIOCSETD request, then exploit the flaw. Not allowing automatic loading removes that route for unprivileged users.

How it works

Sets dev.tty.ldisc_autoload to 0. Line disciplines that are built in or already loaded still work, but the kernel no longer loads additional ones on request from a program without the needed privilege.

Who should use it

Nearly all desktops and servers. Leave it off if you use serial-attached gear that relies on loading such a module on demand, for example some SLIP, CAN-over-serial or modem setups.

What you may notice

Usually nothing. If a rare serial tool fails with an error about an unknown line discipline, an administrator can load the matching module by hand first.

Check it on your computer

Read the current value:

sysctl dev.tty.ldisc_autoload

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w dev.tty.ldisc_autoload=0

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-kernel-ldisc-autoload.conf <<'EOF'
dev.tty.ldisc_autoload = 0
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Block obscure network protocols
• Restrict userfaultfd

Sources

Linux Hardening Guide (madaidans)

2.2.1