[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 1 Feb 2020 13:26:38 +0000
From: Patrick Schleizer <adrelanos@...eup.net>
To: lkrg-users@...ts.openwall.com
Subject: Compiling LKRG static into the Kernel / Loading LKRG kernel module as
early as possible or after other modules?
These are two separate questions, but perhaps related.
1) Is it possible, and sane (considered, tested) to compile LKRG
statically into the Linux kernel? I.e. not use LKRG as a module.
2) When using LKRG as a module, when is the best (recommended, tested,
sane) time the load it? Should LKRG be loaded "late", i.e. after all
other modules are load but still still "early" during boot (before
networking and most other services come up)?
This is what is currently implemented in my LKRG Debian packaging
project. This is just to avoid false positives. I.e. not confuse/scare
users with messages by LKRG about module load/unload and kernel
modifications.
Recently we implemented an initramfs-hook to load sysctl inside
initramfs, i.e. earlier than the systemd-sysctl service. Even before
systemd is started. Made me wonder, if it wouldn't also make sense to
load LKRG as early as possible.
However, loading LKRG "late" for the sake of "not confuse/scare users
with messages by LKRG about" is a security disadvantage which might not
be necessary.
Would it make sense if LKRG had a module parameter and sysctl
"earlyloading=1"? In that mode LKRG wouldn't show some messages such as
about module load and unload - because then that's expected. And maybe
also be more lenient about "some other things"? After some time it would
be the job of the system/package to set sysctl "earlyloading=0" (through
a systemd unit file after systemd-modules-load service), thereby LKRG
going back to "normal mode" (what's implemented now).
Kind regards,
Patrick
Adam Zabrocki:
> ...
> It is important to note that before you run LKRG, you should load "overlay"
> module used by docker. If you don't do it (e.g. load "overlay" module after
> LKRG), not all hooks will be installed and you will see False Positives. The
> easiest way to solve it is to configure the system to load "overlay" during
> boot. You can do it by runnig, for example, the following command:
>
> root@...-ubuntu:~# echo "overlay" > /etc/modules-load.d/overlay.conf
>...
Kind regards,
Patrick
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
