What are kernel modules ?#

Linux kernel modules (LKMs) are loadable pieces of code think of them as plugins that can be added or removed from the Linux kernel on demand, without requiring a reboot. This allows updates to drivers without restarting the system, making the Linux kernel more lightweight and quicker to boot. It’s also more memory-efficient, as only the loaded modules consume memory, unlike when all drivers are compiled directly into the kernel.

Kernel modules are typically stored in /lib/modules/ and have a .ko (kernel object) file extension. However, a module doesn’t need to reside in this directory to be loaded.

• Types of Modules:

  • Security: AppArmor (to restrict application access to system resources.)
  • Device Drivers: NVIDIA GPU drivers.
  • Filesystems: ntfs.ko for NTFS support.
  • Networking: VPN modules like tun.ko.

Interacting with kernel modules#

ls -l /lib/modules/$(uname -r)/*

lsmod | less

modinfo bluetooth

Writing your own kernel module#

Although Linux kernel modules are written in C, they differ from user-space programs because the Linux kernel does not use the standard C library (glibc). Functions like printf are unavailable in kernel space, as glibc is designed for user-space applications and is not accessible from within the kernel.

However, the naming conventions in the kernel are often similar. For example, printf in user space has a kernel equivalent called printk.

Here’s a example of a linux kernel module that prints our given text in dmesg :

#include <linux/module.h>
#include <linux/kernel.h>

static int __init mymodule_init(void) {
    printk(KERN_INFO "Hack the planet!\n");
    return 0;
}

static void __exit mymodule_exit(void) {
    printk(KERN_INFO "Your module is unloaded (:\n");
}

module_init(mymodule_init);
module_exit(mymodule_exit);

Easiest way to compile this into a kernel module is to make a Makefile:

obj-m += custommodule.o
all:
	make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules
clean:
	make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

We can now compile our code using make in the directory our code file resides in.

Loading & Unloading modules#

To load and unload kernel modules we can use utilities such as :

1. insmod
2. rmmod
3. modprobe

The key difference between insmod/rmmod and modprobe is that modprobe can handle module dependencies, whereas insmod and rmmod cannot. Dependency handling means that the kernel automatically loads any additional modules required for a given module to function properly—such as hardware drivers or other kernel components.

When you use insmod to load a module, it does not automatically load its dependencies. If a required module is missing, insmod will fail and return an error. In contrast, modprobe will detect and load all necessary dependencies before loading the target module, ensuring proper functionality.

insmod custommodule.ko

rmmod custommodule

Debugging issues#

Here we are common issues that we can face when dealing with linux kernel modules .

modprobe --show-depends bluetooth

Security tools in the linux kernel#

• Selinux
• Apparmor
• EBPF

In order to understand these systems we have to understand different security levels we have when it comes to a systems security . We have levels

1. DAC : User controlled permissions such as chmod
2. MAC : System wide policies inforced by the kernel e.g : selinux,apparmor
3. Rbac: role based permissions e.g : kubernetes

sestatus

setenforce 0 # permissive
setenforce 1 # Enforcing

semanage port -a -t http_port_t -p tcp 8080

sudo semanage port -l

aa-status

aa-complain /usr/sbin/apache2

aa-genprof /usr/bin/chromium