Dockerfile: address review on strip-exploit-modules patch

Reword the comment: "modules used only as exploit paths" implied
they were written to be exploited. Reframe as "unused in the VM
but expose known CVEs".

Move the strip logic into /usr/local/lib/strip-exploit-modules.sh.
The sed payload reduces to a single source injection, and the
module list becomes a real loop.

Verified on aarch64: rebuilt the builder image and a fresh std
ISO; boot/modloop-virt has the four modules absent and modules.dep
clean.

Signed-off-by: Jan Dubois <jan.dubois@suse.com>

Author: jandubois

Dockerfile

@@ -40,11 +40,17 @@ RUN \
 # Remove --no-chown which is deprecated in apk 3.0 as alias for --usermode (disallowed as root)
 RUN sed -i 's/--initdb --no-chown/--initdb/' /home/build/aports/scripts/mkimage.sh
 
-# Strip kernel modules used only as exploit paths (CVE-2026-43284 dirtyfrag
-# esp4/esp6; CVE-2026-43500 dirtyfrag rxrpc; CVE-2026-31431 copy.fail
-# algif_aead). update-kernel has no exclude flag, so we delete the .ko files
-# from $ROOTFS before the cp -a into $MODLOOP, then re-run depmod to keep
-# modules.dep consistent.
-RUN sed -i 's|^cp -a $ROOTFS/lib/modules $MODLOOP$|find "$ROOTFS/lib/modules/$KVER/kernel" \\( -name "esp4.ko*" -o -name "esp6.ko*" -o -name "rxrpc.ko*" -o -name "algif_aead.ko*" \\) -delete\n$MOCK depmod -b $ROOTFS "$KVER"\n&|' /usr/sbin/update-kernel
+# Strip kernel modules that are unused in the VM but expose known CVEs
+# (CVE-2026-43284 dirtyfrag esp4/esp6; CVE-2026-43500 dirtyfrag rxrpc;
+# CVE-2026-31431 copy.fail algif_aead). update-kernel has no exclude
+# flag, so we inject a hook before its `cp -a ... $MODLOOP` line; depmod
+# re-runs to keep modules.dep consistent.
+RUN cat > /usr/local/lib/strip-exploit-modules.sh <<'EOF'
+for mod in esp4 esp6 rxrpc algif_aead; do
+    find "$ROOTFS/lib/modules/$KVER/kernel" -name "$mod.ko*" -delete
+done
+$MOCK depmod -b "$ROOTFS" "$KVER"
+EOF
+RUN sed -i 's|^cp -a $ROOTFS/lib/modules $MODLOOP$|. /usr/local/lib/strip-exploit-modules.sh\n&|' /usr/sbin/update-kernel
 WORKDIR /home/build/aports/scripts
 ENTRYPOINT ["sh", "./mkimage.sh"]