Post #2502323
2026-04-30 13:34 UTC
@data0@indieweb.social Or put a selinux rule in place to block AF_ALG system wide in casae you can't update.
Replies (1)
-
@data0@indieweb.social 2026-04-30 14:19
@agowa338@chaos.social Yup. There's also the option to block the `algif_aead` kernel module in the modprobe config. All distros I've checked so far compile it as a module (`CONFIG_CRYPTO_USER_API_AEAD=m`). Just be aware that blocking this may break things, albeit the chances seem low. As far as I understand, this functionality is only used by some older IPsec VPN software.