Inserting custom module taints kernel

Question

I just want to insert a module without tainting the kernel.

This is the file test1.c

#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>

MODULE_LICENSE("GPL")
MODULE_AUTHOR("AUTHOR")
MODULE_DESCRIPTION("DESCRIPTION")

static int __init module_hello(void) {
    printk(KERN_ALERT "Hello");
    return 0;
}

static void __exit module_bye(void) {
    printk(KERN_ALERT "Bye");
}

module_init(module_hello);
module_exit(module_bye);

and in the same folder, the file Makefile, as decribed in kernel.org section 3

ifneq ($(KERNELRELEASE),)

obj-m  := test1.o

else

KDIR ?= /lib/modules/`uname -r`/build

default:
    $(MAKE) -C $(KDIR) M=$$PWD

endif

Executing make creates the necessary files correctly, but when I insert it I get the message Loading out-of-tree modules taints kernel, and I don't get the output of the module_hello until I remove the module, and after that, if I insert it again I get the message from the module_bye function, but not the hello one.

score 3 · Answer 1 · answered Jul 31 '18 at 14:53

3

The delay in message is because of missing \n at the end of each print. a \n puts the data from the kernel message buffer to file.

For the tainted kernel refer to this link

answered Jul 31 '18 at 14:53

yashC

887
7
20

Garmekain · Accepted Answer · 2018-07-31T16:42:09.667

0

As in kernel.org section 1,

[...] all modules are initially developed and built out-of-tree.

So, at first the kernel will be tainted.

edited Jul 31 '18 at 16:42

answered Jul 31 '18 at 16:14

Garmekain

664
5
18

score 0 · Answer 3 · edited Oct 08 '20 at 05:14

I'm using next Makefile to sign newly created module: the workflow is:"make clean; make;make key; make cp; make sign ; make install"

CONFIG_MODULE_SIG:=y

#https://stackoverflow.com/questions/24975377/kvm-module-verification-failed-signature-and-or-required-key-missing-taintin
kernel:=$(shell uname -r)
KSRC:=/usr/src/kernels/${kernel}
KBDIR:=/usr/lib/modules/${kernel}/build
KROOT:=/usr/lib/modules/${kernel}
#CONFIG_MODULE_SIG:=y
#/usr/lib/modules/4.18.0-193.19.1.el8_2.x86_64/extra/kvedemo.ko
#  /lib/modules/4.18.0-193.19.1.el8_2.x86_64/kernel/lib/kvedemo.ko
INSTALLPATH:=${KROOT}/kernel/lib
INSTALLPATH2:=${KROOT}/extra
#CONFIG_MODULE_SIG=y
# obj-m is a list of what kernel modules to build.  The .o and other
# objects will be automatically built from the corresponding .c file -
# no need to list the source files explicitly.
driver:=kvedemo
obj-m:= ${driver}.o

# KSRC is the location of the kernel source.  The current standard is
# to link to the associated source tree from the directory containing
# the compiled modules.

    # PWD is the current working directory and the location of our module
    # source files.
    PWD:= $(shell pwd)
    test:
        echo    ${KROOT}
        ls  ${KROOT}
    ${driver}.ko:   ${driver}.c
        $(MAKE) -C $(KSRC) M=$(PWD) 
    clean:
    #   rm *.o *.ko
        $(MAKE) -C $(KBDIR) M=$(PWD) clean
    key:
        openssl req -new -nodes -utf8 -sha512 -days 36500 -batch -x509 -config x509.genkey -outform DER -out signing_key.x509 -keyout signing_key.priv
        openssl req -x509 -newkey rsa:4096 -nodes -utf8 -sha512 -days 36500 \
    -batch -config ./configuration_file.config -outform DER \
    -out my_signing_key_pub.der \
    -keyout kernel-signing_key.priv
    cp:
        sudo cp signing_key.x509 ${KSRC}/certs/
        sudo cp signing_key.priv ${KSRC}/certs/
        sudo cp signing_key.pem ${KSRC}/certs/
    
    pem:
        openssl req -new -nodes -utf8 -sha512 -days 36500 -batch -x509 -config x509.genkey -outform PEM -out kernel_key.pem -keyout ./signing_key.pem
    priv:
        openssl req -x509 -newkey rsa:4096 -nodes -utf8 -sha256 -days 36500 \
    -batch -config configuration_file.config -outform DER \
    -out my_kernel-signing_key_pub.der \
    -keyout kernel-signing_key.priv
    #   openssl req -newkey  rsa:4096 -nodes -utf8 sha512 -days 3650 -batch -x509 -config ./kernel-signing_key.x509 -outform PEM -out kernel-signing_key.x509  -keyout ./kernel-signkey.priv
    sign:${driver}.ko
    #/usr/src/kernels/4.18.0-193.19.1.el8_2.x86_64/scripts/sign-file sha512 ./kernel-signing_key.priv ./kernel-signing_key.x509 kvedemo.ko
    ${KSRC}/scripts/sign-file sha512 ./signing_key.priv ./signing_key.x509 ${driver}.ko
install:${driver}.ko
    sudo cp ${driver}.ko ${INSTALLPATH}/
    sudo  depmod -a 
#   sudo ls -l  ${INSTALLPATH}
modules_install:${driver}.ko
#   hexdump -C /usr/lib/modules/4.18.0-193.19.1.el8_2.x86_64/extra/kvedemo.ko 
    sudo   $(MAKE) -C $(KBDIR) M=$(PWD) modules_install   CONFIG_MODULE_SIG=y
    sudo  depmod -a
    
# default is the default make target.  The rule here says to run make
# with a working directory of the directory containing the kernel
# source and compile only the modules in the PWD (local) directory.
#default:
#   $(MAKE) -C $(KSRC) M=$(PWD) modules
after make clean ; make you have to generate key with `make key`then sign your module by`make sign`then install it `make install`

Inserting custom module taints kernel

3 Answers3