jnuyens/modulejail

ModuleJail is a single shell script that reduces a Linux server's exposure to kernel security bugs by blocking every kernel module the system is not actually using right now. A typical Linux machine ships with thousands of kernel modules but only loads a few hundred of them, and each unused module that stays enabled is still a potential entry point if a security flaw is later found in it. The tool's idea is simple: if a module is not loaded when the script runs, add it to a blacklist file so the system will refuse to load it going forward. The project exists because AI assisted security research is expected to uncover a wave of long hidden bugs in Linux kernel modules over the coming months, arriving faster than sysadmins can patch every affected server. ModuleJail cannot fix any of those bugs, but it can immediately shrink the number of modules that could be affected on a given machine, buying operators time to schedule real patches instead of reacting to emergencies. It works by checking which modules are currently loaded and comparing that list against every module available for the running kernel. Anything not currently loaded, aside from a small built in set of essential modules and any modules a system administrator explicitly allows, gets written into a configuration file that blocks it from loading. There is no daemon, no ongoing monitoring, and no artificial intelligence inside the tool itself: it runs once and produces one file. It can be installed by piping a script from the project's GitHub page into a shell with administrator rights, though the README recommends downloading and reading the script first rather than running it blindly. Prebuilt packages are also available for Debian, Ubuntu, RHEL, Fedora, and Rocky Linux. Three built in profiles, minimal, conservative, and desktop, control how cautious the blacklist is, with desktop preserving modules for WiFi, Bluetooth, audio, and video hardware. This tool is meant for people who manage Linux servers and want a fast, low effort way to reduce their exposure to future kernel vulnerabilities without adding complex monitoring software.