Jasper Nuyens, the founder of Linux Belgium, who developed an add-on for using Linux in the information system of Tesla cars, proposed a simple way to reduce the attack surface of the Linux kernel to decrease the likelihood of compromise in light of the surge in the discovery of dangerous vulnerabilities using AI. Since many vulnerabilities are typically found in specific kernel modules that are available for autoloading but are generally not utilized by most users, Jasper suggested blocking unused modules or rarely used modules by default in the current system.
The kernel includes several thousand modules, but most systems use only a few hundred, while the rest remain available for loading and may potentially contain vulnerabilities. The idea is implemented through the ModuleJail script, which identifies the list of modules used in the current system (via /proc/modules) and automatically blacklists unused modules. The script is written in shell, uses common system utilities (sufficiently busybox) and is distributed under the GPLv3 license.
The script supports execution in Debian, Ubuntu, RHEL, Fedora, SUSE, AlmaLinux, Rocky Linux, Alpine, and Arch Linux, and as a result of its work, it generates the file /etc/modprobe.d/modulejail-blacklist.conf, which is used by the system to disable the autoloading of kernel modules. This approach allows for proactive protection of your system without resorting to loading specialized kernel modules or executing additional background processes to monitor the system.
If necessary, users are given the option to add modules that are currently not loaded but may potentially be used in operation to the whitelist. Profiles that allow the use of the most necessary modules for typical system applications are also available for inclusion. Proposed profiles include 'minimal' (only the most essential modules and core filesystems), 'conservative' (+ standard drivers for servers and virtualnih naprav) and desktop (+ drivers for WiFi, Bluetooth, sound, and video).
Izvor: opennet.ru
