Security Architecture: Kernel Demolition vs Software Interface Disabling

[bootlace-dev]

Discussion / Issue: Kernel Network Interface Demolition vs Software Disabling on Commodity x86 Hardware

Context & Inbound Community Question:

"Did you take steps to disable any networking interfaces? Curious what that entirely looks like and how it differs to play with on a laptop than on something like a pi where the hardware is all 100% known ahead of time." (via Nostr peer review)

---

1. Problem Statement

On fixed single-board computers (like a Raspberry Pi Zero / Pi 4), hardware peripherals are known in advance. On commodity x86 laptops, hardware configurations vary widely (Intel, Realtek, Broadcom, Atheros, Marvell, USB dongles).

Standard live OS distributions attempt to disable networking in userspace via:

• rfkill block all
• ip link set <dev> down
• Blacklisting kernel modules in /etc/modprobe.d/

Vulnerability: Userspace commands and modprobe blacklists are easily bypassed by malicious binaries, shell escapes, or rogue dependencies re-executing modprobe or unblocking interfaces.

---

2. SubZero Keyosk Defense-in-Depth Architecture

To eliminate reliance on userspace enforcement across unpredictable x86 hardware, SubZero executes physical kernel demolition during the OS build phase:

1. Protocol Stack Annihilation:

   • Physically deletes /lib/modules/*/kernel/net/ from the rootfs squashfs image.
   • The OS kernel physically cannot instantiate TCP, UDP, IPv4, IPv6, or raw network sockets. Any socket(AF_INET, ...) syscall fails at the kernel boundary.

2. Hardware Driver Purge:

   • Deletes /lib/modules/*/kernel/drivers/net/ (Ethernet NICs).
   • Deletes /lib/modules/*/kernel/drivers/net/wireless/ (Wi-Fi chipsets).
   • Deletes /lib/modules/*/kernel/drivers/bluetooth/ (Bluetooth controllers).
   • Deletes /lib/modules/*/kernel/drivers/net/usb/ (USB Ethernet/Wi-Fi dongles).

3. DMA Isolation via Kernel Command Line:

   • GRUB boots with intel_iommu=on amd_iommu=on iommu=force efi=disable_early_pci_dma.
   • Protects system RAM against malicious Thunderbolt, FireWire, or PCI-e DMA sniffing attacks.

---

3. Threat Model Comparison: Commodity x86 vs. Fixed SBC (Pi)

Dimension	Commodity x86 Laptop (SubZero Approach)	Fixed Hardware SBC (e.g. Raspberry Pi 4)
Driver Attack Surface	Zero (Drivers physically deleted from rootfs)	Minimal (Typically relies on base OS config or headless kernel)
Hardware Supply Chain	Sourced from local e-waste / existing discarded laptops ($0 cost, untraceable KYC)	Purchased from specialized vendors / Pi distributors (KYC tracking)
Physical USB Dongle Injection	Completely inert (Kernel cannot enumerate USB NICs)	Dependent on whether USB networking modules are compiled in
DMA Protection	Hardware IOMMU enforced at boot	Limited / no IOMMU on Pi 4

---

4. Action Items & Verification

• Add explicit build verification step in CI to assert find /lib/modules -name "*net*" | wc -l == 0.
• Document the iommu=force verification command in docs for users auditing their boot logs (dmesg | grep -i iommu).