Understanding the Linux Kernel, 3rd Edition

Linking and Unlinking Modules

A user can link a module into the running kernel by executing the insmod external program. This program performs the following operations:

1. Reads from the command line the name of the module to be linked.

2. Locates the file containing the module’s object code in the system directory tree. The file is usually placed in some subdirectory below /lib/modules.

3. Reads from disk the file containing the module’s object code.

4. Invokes the init_module( ) system call, passing to it the address of the User Mode buffer containing the module’s object code, the length of the object code, and the User Mode memory area containing the parameters of the insmod program.

5. Terminates.

The sys_init_module( ) service routine does all the real work; it performs the following main operations:

1. Checks whether the user is allowed to link the module (the current process must have the CAP_SYS_MODULE capability). In every situation where one is adding functionality to a kernel, which has access to all data and processes on the system, security is a paramount concern.

2. Allocates a temporary memory area for the module’s object code; then, copies into this memory area the data in the User Mode buffer passed as first parameter of the system call.

3. Checks that the data in the memory area effectively represents a module’s ELF object; otherwise, returns an error code.

4. Allocates a memory area for the parameters passed to the insmod program, and fills it with the data in the User Mode buffer whose address ...