modulejail v1.6.3

modulejail v1.6.3

• --destdir DIR and --initramfs-builder NAME for package builds
  (asked for in the Fedora package review, bug 2541665). With
  --install-initramfs-hook, these write the strip hook into a staging
  root such as %{buildroot}, so a distro package can own the hook in its
  file list instead of creating unowned files from %post. No root needed,
  no host detection, and none of the host-only steps (ostree skip, rebuild
  advice, legacy pacman trigger cleanup). --destdir requires
  --initramfs-builder and rejects --uninstall-initramfs-hook and
  blacklist generation flags. The upstream RPM spec now uses it:
  /usr/lib/dracut/modules.d/99modulejail-strip/ is a packaged file, and
  the %post / %preun hook calls are gone. --initramfs-builder also
  works on its own to override detection. Fixture:
  install-initramfs-hook-destdir.sh.

• Build-time switch to ship with the update check off. Distro packages
  update through the package manager, so the post-run GitHub lookup is
  noise there. Packagers run
  sed -i 's/^UPDATE_CHECK_DEFAULT=1$/UPDATE_CHECK_DEFAULT=0/' modulejail
  at build time. MODULEJAIL_NO_UPDATE_CHECK keeps working per run on
  builds that leave it on. Fixture: update-check-build-switch.sh (also
  checks that the documented sed line changes exactly one line).

• modulejail(8) now documents the initramfs hook flags, which it had
  never covered.

• --install-initramfs-hook skips cleanly on ostree / immutable systems
  (Fedora Silverblue, Kinoite, CoreOS, bootc; prompted by @richarddribeiro's
  Silverblue question in #33). It used to fail with a raw Read-only file system error trying to write a dracut module under the immutable /usr.
  Now it detects /run/ostree-booted and skips with an explanation, returning
  0 (important for the packaged post-install, which runs the flag
  automatically). The skip is safe because the hook is unnecessary there:
  verified on Silverblue 45 that the initramfs is image-provided and never
  includes /etc/modprobe.d, even with host-local regeneration
  (rpm-ostree initramfs --enable) turned on, so the gh #19
  upgrade-then-stale trap the hook guards against does not exist. modulejail's
  core function is unaffected: it writes the blacklist to the writable /etc
  and modprobe honors it normally. Fixture: ostree-initramfs-hook-skip.sh.

• docs/DEFENSE-IN-DEPTH.md: worked example for the October 2026 CVE
  batch. Sorts the eleven kernel CVEs NVD published on 2026-10-18 into
  the autoload tiers: two reachable by an unprivileged user (RDS,
  CVE-2026-98560; act_ct via user namespaces, CVE-2026-98441), six that
  need hardware or root, and three in built-in code that ModuleJail cannot
  touch. Also adds the tc autoload path (act_*, cls_*, sch_* over
  rtnetlink) to the Tier 6 table.