{"id":170848,"date":"2026-05-18T00:24:30","date_gmt":"2026-05-17T22:24:30","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/modulejail-dlya-blokirovki-neispolzuemyh-modulej-yadra-linux"},"modified":"2026-05-18T00:24:30","modified_gmt":"2026-05-17T22:24:30","slug":"modulejail-dlya-blokirovki-neispolzuemyh-modulej-yadra-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/modulejail-dlya-blokirovki-neispolzuemyh-modulej-yadra-linux","title":{"rendered":"ModuleJail na blokovanie nepou\u017e\u00edvan\u00fdch modulov jadra Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jasper Nuyens, zakladate\u013e organiz\u00e1cie Linux Belgium, ktor\u00fd vytvoril nadstavbu pre vyu\u017e\u00edvanie Linuxu v informa\u010dnom syst\u00e9me automobilov Tesla, navrhol jednoduch\u00fd sp\u00f4sob, ako zn\u00ed\u017ei\u0165 \u00fato\u010dn\u00fa plochu na jadro Linuxu, aby sa zn\u00ed\u017eila pravdepodobnos\u0165 kompromit\u00e1cie v s\u00favislosti s n\u00e1rastom odhalenia nebezpe\u010dn\u00fdch zranite\u013enost\u00ed pomocou AI. Ke\u010f\u017ee mnoh\u00e9 zranite\u013enosti sa zvy\u010dajne nach\u00e1dzaj\u00fa v \u0161pecifick\u00fdch moduloch jadra dostupn\u00fdch pre automatick\u00e9 na\u010d\u00edtanie, av\u0161ak zvy\u010dajne nevyu\u017e\u00edvan\u00fdch v\u00e4\u010d\u0161inou pou\u017e\u00edvate\u013eov, Jasper navrhol predvolene blokova\u0165 nepou\u017e\u00edvan\u00e9 moduly v aktu\u00e1lnom syst\u00e9me alebo vo v\u0161eobecnosti zriedka pou\u017e\u00edvan\u00e9 moduly. <\/p>\n

V jadre je k dispoz\u00edcii nieko\u013eko tis\u00edc modulov, ale v v\u00e4\u010d\u0161ine syst\u00e9mov sa pou\u017e\u00edva len nieko\u013eko stoviek, zatia\u013e \u010do ostatn\u00e9 zost\u00e1vaj\u00fa dostupn\u00e9 na na\u010d\u00edtanie a potenci\u00e1lne m\u00f4\u017eu obsahova\u0165 zranite\u013enosti. N\u00e1pad je realizovan\u00fd prostredn\u00edctvom skriptu ModuleJail, ktor\u00fd ur\u010duje zoznam pou\u017e\u00edvan\u00fdch modulov v aktu\u00e1lnom syst\u00e9me (cez \/proc\/modules) a automaticky umiest\u0148uje nepou\u017e\u00edvan\u00e9 moduly na \u010diernu listinu. Skript je nap\u00edsan\u00fd v shelli, vyu\u017e\u00edva be\u017en\u00e9 syst\u00e9mov\u00e9 utility (sta\u010d\u00ed busybox) a \u0161\u00edri sa pod licenciou GPLv3. <\/p>\n

Skript podporuje fungovanie v Debian, Ubuntu, RHEL, Fedora, SUSE, AlmaLinux, Rocky Linux, Alpine a Arch Linux, a v d\u00f4sledku svojej \u010dinnosti generuje s\u00fabor \/etc\/modprobe.d\/modulejail-blacklist.conf, ktor\u00fd je \u0161tandardne pou\u017e\u00edvan\u00fd v syst\u00e9me na vypnutie automatick\u00e9ho na\u010d\u00edtania modulov jadra. Tak\u00fdto pr\u00edstup umo\u017e\u0148uje prevent\u00edvne chr\u00e1ni\u0165 svoj syst\u00e9m, bez toho, aby bolo potrebn\u00e9 na\u010d\u00edtava\u0165 \u0161pecializovan\u00e9 moduly jadra alebo vykon\u00e1va\u0165 dodato\u010dn\u00e9 pozadov\u00e9 procesy na monitorovanie syst\u00e9mu. <\/p>\n

V pr\u00edpade potreby m\u00e1 pou\u017e\u00edvate\u013e mo\u017enos\u0165 prida\u0165 do bieleho zoznamu moduly, ktor\u00e9 nie s\u00fa moment\u00e1lne na\u010d\u00edtan\u00e9, ale potenci\u00e1lne m\u00f4\u017eu by\u0165 pou\u017eit\u00e9 v prev\u00e1dzke. Rovnako s\u00fa dostupn\u00e9 profily, ktor\u00e9 umo\u017e\u0148uj\u00fa vyu\u017e\u00edvanie najpotrebnej\u0161\u00edch modulov pre typick\u00e9 aplik\u00e1cie syst\u00e9mu. Navrhnut\u00e9 s\u00fa profily \u201eminimal\u201c (iba najd\u00f4le\u017eitej\u0161ie moduly a z\u00e1kladn\u00e9 FS), \u201econservative\u201c (+ typick\u00e9 ovl\u00e1da\u010de pre servery a virtu\u00e1ln\u00edch stroj\u016f<\/a>) a desktop (+ ovl\u00e1da\u010de pre WiFi, Bluetooth, zvuk a video).
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u0436\u0430\u0441\u043f\u0435\u0440 \u041d\u044e\u0439\u0435\u043d\u0441 (Jasper Nuyens), \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux Belgium, \u0441\u043e\u0437\u0434\u0430\u0432\u0448\u0438\u0439 \u043d\u0430\u0434\u0441\u0442\u0440\u043e\u0439\u043a\u0443 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f Linux \u0432 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0430\u0432\u0442\u043e\u043c\u043e\u0431\u0438\u043b\u0435\u0439 Tesla, \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u043f\u0440\u043e\u0441\u0442\u043e\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u044f\u0434\u0440\u043e Linux \u0434\u043b\u044f \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u043d\u0430 \u0444\u043e\u043d\u0435 \u0432\u0441\u043f\u043b\u0435\u0441\u043a\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043e\u043f\u0430\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 AI. \u0422\u0430\u043a \u043a\u0430\u043a \u043c\u043d\u043e\u0433\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u043d\u0430\u0445\u043e\u0434\u044f\u0442 \u0432 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u043d\u044b\u0445 \u043c\u043e\u0434\u0443\u043b\u044f\u0445 \u044f\u0434\u0440\u0430, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170848","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47ModuleJail na blokovanie nepou\u017e\u00edvan\u00fdch modulov jadra Linux | ProHoster","description":"Jasper Nuyens, zakladate\u013e organiz\u00e1cie Linux Belgium, ktor\u00fd vytvoril nadstavbu pre vyu\u017e\u00edvanie Linuxu v informa\u010dnom syst\u00e9me automobilov Tesla, navrhol jednoduch\u00fd sp\u00f4sob, ako zn\u00ed\u017ei\u0165 \u00fato\u010dn\u00fa plochu na.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/modulejail-dlya-blokirovki-neispolzuemyh-modulej-yadra-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47ModuleJail \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043d\u0435\u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u044f\u0434\u0440\u0430 Linux | ProHoster","og:description":"\u0414\u0436\u0430\u0441\u043f\u0435\u0440 \u041d\u044e\u0439\u0435\u043d\u0441 (Jasper Nuyens), \u043e\u0441\u043d\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 Linux Belgium, \u0441\u043e\u0437\u0434\u0430\u0432\u0448\u0438\u0439 \u043d\u0430\u0434\u0441\u0442\u0440\u043e\u0439\u043a\u0443 \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f Linux \u0432 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0430\u0432\u0442\u043e\u043c\u043e\u0431\u0438\u043b\u0435\u0439 Tesla, \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b \u043f\u0440\u043e\u0441\u0442\u043e\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u043f\u043e\u0432\u0435\u0440\u0445\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u0438 \u043d\u0430.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/modulejail-dlya-blokirovki-neispolzuemyh-modulej-yadra-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-17T22:24:30+00:00","article:modified_time":"2026-05-17T22:24:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/170848","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=170848"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/170848\/revisions"}],"predecessor-version":[{"id":181605,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/170848\/revisions\/181605"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=170848"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=170848"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=170848"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}