lurch (he/him)

he/him

  • 0 Posts
  • 444 Comments
Joined 1 year ago
cake
Cake day: October 4th, 2023

help-circle



  • i just read there is even some kind of macro for switching all modules to built-in:

    make mod2yesconfig
    # and/or
    make localyesconfig
    

    Also, the module blacklist file may accept wildcards, so you can blacklist all modules. And there is a sysctl switch “kernel.modules_disabled”, which lets you switch module changes off and on as required. Then again, an attacker who gained root to load modules could also re-enable it and de-blacklist his modules; so this is a lot weaker.

    //edit: the blacklist is useless for security, because it only affects easy module loading with modprobe, not using insmod what an attacker would use.



  • compiling a kernel from the provided source is surprisingly easy tho. you can start with the default config from your distro, just toggle the options you want different in the menuconfig and compile it. there are howtos. also, once a pro has done it, they can share the config for others with similar setups.

    if you fail and your kernel is broken, you can just use the old one again until you get it right. just don’t overwrite the old one when putting it where the boot loader is looking for it and give the new one it’s own boot loader entry.



  • if you don’t want modules, you can compile a monolithic kernel. i have done so for a few years. it saves time if you run something like gentoo or LFS, because you don’t need an initrd and no mechanisms for loading modules. it has the downside of not being able to change some parameters during runtime, ie. you have to reboot and pass different parameters via booloader. you can then also switch off support for loading modules.