linux-kernel - Unremovable kernel module with one line of code.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1549627591.455.7.camel@zibri.org>
Date:   Fri, 08 Feb 2019 14:06:31 +0200
From:   Zibri <zibri@...ri.org>
To:     linux-kernel@...r.kernel.org
Subject: Unremovable kernel module with one line of code.

All is needed in a kernel module to make it unremovable without a
reboot is a single line of code. This should not be possible IMHO.

#include <linux/module.h>	/* Needed by all modules */
#include <linux/kernel.h>	/* Needed for KERN_INFO */

int init_module(void)
{
	printk(KERN_INFO "Hello world.\n");
	THIS_MODULE->name[0]=0x41; //or any other character than "h"
	return 0;
}

void cleanup_module(void)
{
	printk(KERN_INFO "Goodbye world.\n");
}

After the modue "hello.ko" is loaded, changing the first letter of the
module name to anything different than the original first letter of the
module names causes it to be unremovable by using rmmod or modprobe -r.
The only way I found so far is (obviously) a reboot.

Solution:
when installing a module, the kernel should assign it an unchangeable
ID. Afterwards, it should always be possible to remove it using that id
and not the name.

Download attachment "signature.asc" of type "application/pgp-signature" (456 bytes)