ModuleJail

ModuleJail is a lightweight, single POSIX shell script designed to enhance the security of a Linux host by minimizing its kernel-module attack surface. By creating a modprobe.d blacklist for all unused kernel modules—except for a core baseline and any additional modules specified by the system administrator—ModuleJail effectively reduces exposure to potential vulnerabilities without the need for complex configurations or ongoing monitoring.

Core Functionality

As systems increasingly become targets for exploitation through kernel privilege escalation vulnerabilities, ModuleJail provides a straightforward solution for system administrators. It eliminates unnecessary kernel modules, significantly lowering the risk of attack from newly disclosed CVEs (Common Vulnerabilities and Exposures). In a typical Linux environment, thousands of kernel modules may be installed, while many are rarely or never used. ModuleJail blacklists these inactive modules, which in turn makes any future vulnerability found in those modules irrelevant to the hardened system.

Key Features:

• Simplicity: ModuleJail operates with one script execution. No daemons, no initramfs modifications, and no artificial intelligence dependencies—just effective security hardening.
• Wide Compatibility: Works across various Linux distributions, including Debian, Ubuntu, RHEL, Fedora, Arch, Alpine, and SUSE, without requiring extensive dependencies.
• Safety Model: It focuses solely on currently loaded modules, ensuring any necessary components are preserved for a smoothly functioning system. This design helps prevent the accidental blacklisting of important modules during operation.
• Flexible Profiles: Comes with three built-in profiles, allowing users to tailor the tool for different environments:
  • Minimal: Only essential kernel modules and core filesystems.
  • Conservative (default): Core modules plus common server drivers.
  • Desktop: Includes additional drivers for WiFi, Bluetooth, and multimedia devices.

Usage Example

ModuleJail minimizes administrative effort with a simple command to blacklist unused modules. To run the script, users can execute the following:

curl -fsSL https://raw.githubusercontent.com/jnuyens/modulejail/v1.1.4/modulejail | sudo sh

For more safety, administrators can download, inspect, and then run the script:

curl -fsSL https://raw.githubusercontent.com/jnuyens/modulejail/v1.1.4/modulejail -o /tmp/modulejail
less /tmp/modulejail
sudo sh /tmp/modulejail

Limitations

ModuleJail intentionally avoids handling initramfs modules and does not include runtime monitoring or revert tools. System administrators are expected to apply the tool during stable system states to minimize the risk of blacklisting necessary components.

Conclusion

ModuleJail stands out as a practical approach to fortify Linux hosts against the evolving landscape of security threats. By efficiently blacklisting unused kernel modules, it empowers system administrators with a proactive tool that helps maintain system integrity and security with minimal overhead.