How to make an extraordinarily incompatible kernel module

salantrax · 08-11-2014, 06:55 AM

Hello!

I was wondering if you could recommend a kernel module that would fail miserably and reliably when inserting it into a "foreign" kernel, i.e. one for which the module was not built.

The plan is to store that module probe/key on an encrypted rootfs and watch for module errors that would indicate that the kernel image has been swapped.

EDIT: That module would get loaded by systemd, according to the list /etc/modules-load.d/modules.conf:

Code:

# List of modules to load at boot
module-that-does-not-play-nice-with-unfamiliar-kernels

unSpawn · 09-06-2014, 04:17 AM

Quote:

Originally Posted by salantrax

I was wondering if you could recommend a kernel module that would fail miserably and reliably when inserting it into a "foreign" kernel, i.e. one for which the module was not built.

Take something that's been deprecated since kernel 2.0.23? ;-p

Quote:

Originally Posted by salantrax

The plan is to store that module probe/key on an encrypted rootfs and watch for module errors that would indicate that the kernel image has been swapped.

...so I load something before your encrypted rootfs is mounted that hides any LKM error messages?

salantrax · 09-08-2014, 01:57 PM

Quote:

Originally Posted by unSpawn

Take something that's been deprecated since kernel 2.0.23? ;-p

Needs to be compatible with current kernel (> 3.16).

Quote:

Originally Posted by unSpawn

...so I load something before your encrypted rootfs is mounted that hides any LKM error messages?

Then how do you explain that the module doesn't say:
"Hello! I loaded successfully, and the secret passphrase is 4324984234."?