Lesson 5.35: Kernel modules and the taint flag
A kernel module runs with the kernel's full power, so a malicious one (a kernel rootkit) can hide files, processes and itself. Hiding leaves traces, though: the kernel records an unsigned or out-of-tree module in its taint flags and its log, and many rootkits remove themselves from lsmod but not from /sys/module. In the lab Northwind's customer database server shows a tainted kernel. You decode the flags, find a module that lsmod doesn't show, compare it with a genuine signed module, find how it loads at boot, and make the call that matters: this kernel can't be trusted. Then you harden the image so the next one is harder.
18 min
You will learn to
- Explain kernel modules and why a malicious one is so dangerous
- Read and decode /proc/sys/kernel/tainted
- Find a module hidden from lsmod through /sys/module
- Check module signatures with modinfo
- Block unneeded modules with modprobe.d
Key terms
- Kernel module
- Code loaded into the running kernel (drivers, file systems, network features); it runs with full kernel privileges.
- Kernel rootkit
- A malicious module that hides files, processes, connections and itself from the system's tools.
- Taint flags
- Bits the kernel sets when something it can't vouch for happens, e.g. O (out-of-tree) and E (unsigned) modules.
- Module signing
- Distribution modules are signed at build time; Secure Boot can make the kernel refuse unsigned ones.
- /etc/modules-load.d
- Lists modules systemd loads at every boot.
- install NAME /bin/false
- A modprobe.d rule that makes every attempt to load NAME fail.
← Controlled package updates · All lessons · Capstone 1: a forensic timeline from first login to persistence →