Jasper Nuyens, founder of Linux Belgium, who created an extension for using Linux in Tesla's automotive information system, proposed a simple way to reduce the attack surface of the Linux kernel to lower the likelihood of compromise amid a surge in the discovery of dangerous vulnerabilities using AI. Since many vulnerabilities are typically found in specific kernel modules that are available for auto-loading but not usually utilized by most users, Jasper suggested defaulting to block unused modules in the current system or generally rarely used modules.
There are several thousand modules available in the kernel, but only a few hundred are used in most systems, while the rest remain available for loading and could potentially contain vulnerabilities. The idea is implemented through the ModuleJail script, which determines the list of modules currently used in the system (via /proc/modules) and automatically blacklists unused modules. The script is written in shell, uses common system utilities (busybox is sufficient), and is distributed under the GPLv3 license.
The script supports execution in Debian, Ubuntu, RHEL, Fedora, SUSE, AlmaLinux, Rocky Linux, Alpine, and Arch Linux, and as a result of its operation, it generates the file /etc/modprobe.d/modulejail-blacklist.conf, which is routinely used in the system to disable auto-loading of kernel modules. Such an approach allows for proactive protection of the system without resorting to loading specialized kernel modules or executing additional background processes to monitor the system.
If necessary, users have the option to whitelist modules that are not currently loaded but could potentially be used. Profiles that allow for the inclusion of the most essential modules for typical system applications are also available. Proposed profiles include "minimal" (only the most critical modules and basic filesystems), "conservative" (+ standard drivers for servers and of virtual machines) and desktop (+ drivers for WiFi, Bluetooth, audio, and video).
Source: opennet.ru
