Agenda

Why should I care? (as a High Level Developper)

Linux Kernel Quick Review

• History
• Monolithic
• Compiled and Statically linked
• Kernel Threads and User Threads
• Virtual File System
• Hardware Dependency
• Linux Versions
• Linux Startup Process

Loadable Kernel Modules

• Kernel Modules
• Not your daily C / Not libc
• Where are they?
• When are they loaded?
• Linux Kernel Ring
• List Loaded Modules
• Which ones is my Hardware using?
• Get Module Info
• Load a Module
• Unload a Module
• Blacklisting Kernel Modules
• Tainted Kernel

Do it Yourself: Compile Your Own Linux Kernel Module

• Hello Kernel Module
• MP3 Rickroll Kernel Module

References

Why should I care? (as a High Level Developper)

Linux Quick Review

History

Compiled and Statically Linked

• Static Kernel Modules
  
• Dynamic Kernel Modules
  

Kernel Threads and User Threads

• Preemptive Theads
• Multiprocessor Support
• Tow types of Threads:
• Kernel Threads
• User Threads: Multithreaded Application Support

Virtual Filesystem Swith

• Specifies an interface (or a "contract") between the kernel and a concrete file system.
• It is easy to add support for new file system types to the kernel simply by fulfilling the contract.

Hardware Dependency

• Distinction between hardware-dependent and hardware-independent code.
• These directories include 23 subdirectories that correspond to the different types of hardware platforms supported
  • arch
  • include

Linux Versions

Linux Versions

• Linux GRSEC
• Linux ZEN
• Linux AUFS (advanced multi layered unification filesystem)
• Linux Apparmor
• Linux BFS (Brain Fuck Scheduler - created by Con Kolivas for desktop computers with fewer than 4096 cores)
• etc...

Linux Startup Process

1. Bootloader Phase
• BIOS: Master Boot Record code
• UEFI: Linux Kernel Can be executed directly
2. Kernel Loading Phase: loads binary
3. Kernel Startup Phase: executes kernel binary
• Load Kernel Data Structures
• Load Kernel Modules
• initrd: initial RAM Disk
• initramfs: initial RAM File System
• mkinitcpio
• Starts init process (SysV init|Systemd|Upstart|runit)

Example Bootloader Configuration File: grub.cfg

Not your daily C / Not libc

• The kernel doesn't use libc.
• The kernel defines some functions like: printk.
• So Kernel Modules are limited: e.g. NO FLOATING POINT ARITHMETIC

Where are they?

/usr/lib/modules/kernel_release

When are they loaded?

Linux Kernel Ring

	[david@JANUS]$ dmesg -T
	    					

List Loaded Modules

	[david@JANUS]$ lsmod
	    					

Which ones is my Hardware using?

	[david@JANUS:~]$ lspci -k
							

Get Module Info

	[david@JANUS]$ modinfo <a kernel module>
	    					

Load a Module (Without Dependencies)

	[david@JANUS]$ insmod <a kernel module>
	    					

Unload a Module

	[david@JANUS]$ rmmod <a kernel module>
	    					

Load/Unload a Module (With Dependencies)

	[david@JANUS]$ modprobe [-r] <a kernel module>
	    					

Blacklisting Kernel Modules

Tainted Kernel

• When the Kernel is in a state that is unsupported by the community
• The kernel may become tainted for any of several reasons:
• Use of a proprietary (or non-GPL compatible) kernel module
• Staging drivers: part of the kernel source code but not fully tested
• etc..

Do It Yourself: Hello Kernel Module

Makefile

obj-m += hello.o
obj-m += hello-packet.o
obj-m += rootkit.o
obj-m += rickroll.o
obj-m += excited_virus.o

all:
	make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules

clean:
	make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

hello.c

#include <linux/module.h>    // included for all kernel modules
#include <linux/kernel.h>    // included for KERN_INFO
#include <linux/init.h>      // included for __init and __exit macros

static int __init hello_init(void)
{
    printk(KERN_INFO "Hello, hacker school!!!\n");
    return 0;    // Non-zero return means that the module couldn't be loaded.
}

static void __exit hello_cleanup(void)
{
  printk(KERN_INFO "I am dead.\n");
}

module_init(hello_init);
module_exit(hello_cleanup);

Compiling the Kernel Modules

Loading the hello Kernel Module

	[david@JANUS:~]$ sudo insmod hello.ko
	[david@JANUS:~]$ sudo rmmod hello.ko
	

Do It Yourself: MP3 Rickroll Kernel Module

This Kernel Module changes the mp3 file you open with any program on your system with the one we want to hear. :)

Rickroll Steps

1. Get your song: rickroll.mp3
2. Change rickroll.c source code (path of your song!!)

rickroll.c

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/syscalls.h>
#include <linux/string.h>


MODULE_LICENSE("GPL");
MODULE_AUTHOR("Kamal Marhubi");
MODULE_DESCRIPTION("Rickroll module");

static char *rickroll_filename = "/home/david/linux/modules/chica/kernel-module-fun/rickroll.mp3";

...

Loading the MP3 Rickroll Kernel Module

	[david@JANUS:~]$ sudo insmod rickroll.ko
	

	[david@JANUS:~]$ sudo rmmod hello.ko
	

Kernel Module Interface: init and exit functions

static int __init rickroll_init(void)
{
    if(!rickroll_filename) {
        printk(KERN_ERR "No rick roll filename given.");
        return -EINVAL;  /* invalid argument */
    }
...
static void __exit rickroll_cleanup(void)
{
    printk(KERN_INFO "Ok, now we're gonna give you up. Sorry.\n");

    /* Restore the original sys_open in the table */
    DISABLE_WRITE_PROTECTION;
    sys_call_table[__NR_open] = (unsigned long *) original_sys_open;
    ENABLE_WRITE_PROTECTION;
}
...
module_init(rickroll_init);
module_exit(rickroll_cleanup);

References

• Understanding the Linux Kernel 3rd. Edition (2006): Daniel P. Bovet, Marco Cesati
• Julia Evans: Systems Programming, Hacker (Linux, Scala, Python), talks, etc.
• Arch Linux Wiki!!!!
• Porting Linux to new Hardware
• Grep Linux Code!