infra-modulejail

Build a KEEP set from currently loaded modules, a baseline profile, and an explicit whitelist, expand it to its dependency closure with modprobe --show-depends, then block everything else via install directives in /etc/modprobe.d. Keep the block runtime-only and never bake it into the initramfs.

An install override like 'install X /bin/true' runs instead of inserting the module, so modprobe prints nothing and exits 0 while loading nothing. Check lsmod and query journalctl -t modulejail for logged refusals if the logger form of the directive was used.

A blacklist entry only stops alias-based autoloading; an explicit modprobe of the name still loads the module. An 'install X /bin/true' override intercepts every future load attempt, which is what a real module jail requires.

A runtime /etc/modprobe.d block takes effect after root is mounted and userspace started, so a wrong entry stays fixable over SSH. Baked into the initramfs, a wrong entry can stop the boot before the disk or NIC driver loads, bricking a host with no console or out-of-band power.

A dependency of the whitelisted module was blocked. The dependency closure must be computed for every kept module, and runtime request_module() helpers like crypto API backends are invisible to --show-depends and must be discovered by exercising the feature and reading the refusal log.

Do not apply it on a machine whose hardware and workload you cannot enumerate and reboot-test first, or where you have no recovery path such as console access, out-of-band power, or on-site hands. Fix the recovery path before hardening.