2

I am building a kernel with OpenWrt for a hardware device. As there will no new pluggable hardware which will be added later, I want to make sure that all kernel modules are built into the kernel. This way I can disable module loading and stop cyber attacks which rely on loading code via modules.

My question- how can I force all selected modules to be automatically built statically into the kernel. I don't want to select the modules individually to make this change. I am looking for a shortcut.

1
  • Normally not recommended, but you could try editing the kernel's .config file, and replace all the =m to =y.
    – sawdust
    May 24, 2018 at 23:55

3 Answers 3

2

If you do this all 3000+ modules will be built and embeded into your kernel. Your kernel will be massively oversized.

This is a terrible idea, but:

make allyesconfig

You need to have the kernel source on the device in question temporarily. Once you do a make localmodconfig you can copy the .config file to another machine, if you want, and compile it there.

What you should do is:

make localmodconfig

Then edit the config file

.config

and do a search and replace for m replacing it with y

Now you will only have about 110 modules, and it will boot faster, and not be massively oversized.

3
  • Thanks! but is there a shortcut to changing the m to y? or is the manual edit the only way? May 25, 2018 at 22:45
  • cat .config| sed 's/=m/=y/g' >.config2. Move .config to a backup folder. rename .config2 .config
    – cybernard
    May 25, 2018 at 22:47
  • Thanks! Sorry don't have enough reputation to upvote this. May 28, 2018 at 19:34
0

To simplify cybernards answer even more:

make localyesconfig will do the same thing as make localmodconfig, execpt all the modules will be automatically marked as built-in!

See the kernel readme and this question for more details.

0

so maybe this will this do the job.

run 'hwinfo' (hopefully enough to probe hardware as I think module need to be loaded and probing hardware will do it) run 'make localyesconfig' in kernel dir (Postulate: 'make localmodconfig' and 'make localyesconfig' both use 'lsmod' to do their stuff)

You might want to chose yes for various stuff like filesystem (proc/config.gz, exfat, vfat and efi stuff can be a good idea) crypto and other more more passive stuff (non hardware) you know you need before your yes kernel by choosing yes on those too. Having /proc/config.gz' is a good idea for later recompiles.

Suggest you keep at least a hardened and an experiment kernel for boot and set the hardened as default in case you got keyboard/screen issues).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .