Unremovable kernel module with one line of code.
From: Zibri
Date: Fri Feb 08 2019 - 07:06:38 EST
All is needed in a kernel module to make it unremovable without a
reboot is a single line of code. This should not be possible IMHO.
#include <linux/module.h> /* Needed by all modules */
#include <linux/kernel.h> /* Needed for KERN_INFO */
int init_module(void)
{
printk(KERN_INFO "Hello world.\n");
THIS_MODULE->name[0]=0x41; //or any other character than "h"
return 0;
}
void cleanup_module(void)
{
printk(KERN_INFO "Goodbye world.\n");
}
After the modue "hello.ko" is loaded, changing the first letter of the
module name to anything different than the original first letter of the
module names causes it to be unremovable by using rmmod or modprobe -r.
The only way I found so far is (obviously) a reboot.
Solution:
when installing a module, the kernel should assign it an unchangeable
ID. Afterwards, it should always be possible to remove it using that id
and not the name.
Attachment:
signature.asc
Description: This is a digitally signed message part