infra-modulejaillisted

Use when hardening a Linux host by preventing the kernel from loading modules it does not need - kernel-module allowlist or blacklist, modprobe install override, reducing request_module/autoload attack surface, CIS module-blacklisting - especially on a remote or relocating host with no console and no out-of-band power, where a wrong module list can leave it unbootable and unreachable. Also use when a module silently refuses to load on an already-jailed host - modprobe exits 0 having loaded nothing, lsmod stays empty, a systemd unit fails with "Dependency failed", or journalctl logs the module as "blocked".
bitranox/bitranox-skills · ★ 1 · AI & Automation · score 57

Install: claude install-skill bitranox/bitranox-skills

# infra-modulejail ## Overview Reduce a host's kernel attack surface by blocking every module except a proven-needed set ("jailing" the module namespace). The danger is not the blocking, it is bricking a host you cannot reach. This skill is the safe procedure. **Core principles:** 1. **Allowlist, then block the complement.** Do NOT hand-pick a short blocklist of "obviously unused" modules (gpu, sound, bluetooth) - that barely dents the surface. Build the KEEP set, then block everything else. A real jail blocks the large majority of the tree. 2. **Keep the block RUNTIME-ONLY. Never bake it into the initramfs.** This is what makes a mistake survivable (see "Why runtime-only"). 3. **Prove three invariants against a dry-run before you apply**, and validate the gate against a known-negative. 4. **A host with no console/OOB power is not hardened until a real reboot proved it while you could still recover it.** ## When to use / not Use when: locking down a server, appliance, hypervisor (Proxmox/KVM host), or an about-to-relocate box; responding to a `request_module()`/autoload CVE class (obscure network protocols - `dccp`, `sctp`, `rds`, `tipc` - or filesystems autoloaded on mount). Do NOT use on a machine whose exact hardware/workload you cannot enumerate and reboot-test first, or where you have no way to recover a bad boot (no console, no OOB power, no on-site hands) - fix the recovery path first. ## The safe method ### 1. Build the KEEP set, then its de