World Library  
Flag as Inappropriate
Email this Article

Loadable kernel module

Article Id: WHEBN0000371658
Reproduction Date:

Title: Loadable kernel module  
Author: World Heritage Encyclopedia
Language: English
Subject: Linux kernel, Zswap, Device driver, Ksplice, Kinsmod
Collection: Freebsd, Linux Kernel, Operating System Kernels
Publisher: World Heritage Encyclopedia

Loadable kernel module

In computing, a loadable kernel module (or LKM) is an object file that contains code to extend the running kernel, or so-called base kernel, of an operating system. LKMs are typically used to add support for new hardware and/or filesystems, or for adding system calls. When the functionality provided by a LKM is no longer required, it can be unloaded in order to free memory and other resources.

Most current Unix-like systems and Microsoft Windows support loadable kernel modules, although they might use a different name for them, such as kernel loadable module (kld) in FreeBSD, kernel extension (kext) in OS X[1] and kernel-mode driver in Windows NT.[2] They are also known as Kernel Loadable Modules (or KLM), and simply as Kernel Modules (KMOD).


  • Advantages 1
  • Disadvantages 2
  • Implementations in different operating systems 3
    • Linux 3.1
      • License issues 3.1.1
        • Linuxant controversy
    • FreeBSD 3.2
    • OS X 3.3
    • NetWare 3.4
  • Binary compatibility 4
  • Security 5
    • Linux 5.1
    • OS X 5.2
  • See also 6
  • References 7
  • External links 8


Without loadable kernel modules, an operating system would have to include all possible anticipated functionality already compiled directly into the base kernel. Much of that functionality would reside in memory without being used, wasting memory, and would require that users rebuild and reboot the base kernel every time they require new functionality. Most operating systems supporting loadable kernel modules will include modules to support most desired functionality.


One minor criticism of preferring a modular kernel over a static kernel is the so-called Fragmentation Penalty. The base kernel is always unpacked into real contiguous memory by its setup routines; so, the base kernel code is never fragmented. Once the system is in a state where modules may be inserted—for example, once the filesystems have been mounted that contain the modules—it is probable that any new kernel code insertion will cause the kernel to become fragmented, thereby introducing a minor performance penalty.

Implementations in different operating systems


Loadable kernel modules in Linux are loaded (and unloaded) by the modprobe command. They are located in /lib/modules and have had the extension .ko ("kernel object") since version 2.6 (previous versions used the .o extension).[3] The lsmod command lists the loaded kernel modules. In emergency cases, when the system fails to boot due to e.g. broken modules, specific modules can be enabled or disabled by modifying the kernel boot parameters list (for example, if using GRUB, by pressing 'e' in the GRUB start menu, then editing the kernel parameter line).

License issues

In the opinion of Linux maintainers, LKM are derived works of the kernel. The Linux maintainers tolerate the distribution of proprietary modules, but allow symbols to be marked as only available to GNU General Public License (GPL) modules.

Loading a proprietary or non-GPL-compatible LKM will set a 'taint' flag[4] in the running kernel—meaning that any problems or bugs experienced will be less likely to be investigated by the maintainers.[5][6] LKMs effectively become part of the running kernel, so can corrupt kernel data structures and produce bugs that may not be able to be investigated if the module is indeed proprietary.

Linuxant controversy

In 2004, Linuxant—a consulting company that releases proprietary device drivers as loadable kernel modules—attempted to abuse a null terminator in their MODULE_LICENSE, as visible in the following code excerpt:

MODULE_LICENSE("GPL\0for files in the \"GPL\" directory; for others, only LICENSE file applies");

The string comparison code used by the kernel at the time tried to determine whether the module was GPLed stopped when it reached a null character (\0), so it would be fooled into thinking that the module was declaring its license to be just "GPL".[7]


Kernel modules for FreeBSD are stored within /boot/kernel/ for modules distributed with the OS, or usually /boot/modules/ for modules installed from FreeBSD ports or FreeBSD packages, or for proprietary or otherwise binary-only modules. FreeBSD kernel modules usually have the extension .ko. Once the machine has booted, they may be loaded with the kldload command, unloaded with kldunload, and listed with kldstat. Modules can also be loaded from the loader before the kernel starts, either automatically (through /boot/loader.conf) or by hand.


Some loadable kernel modules in OS X can be loaded automatically. Loadable kernel modules can also be loaded by the kextload command. They can be listed by the kextstat command. Loadable kernel modules are located in bundles with the extension .kext. Modules supplied with the operating system are stored in the /System/Library/Extensions directory; modules supplied by third parties are in various other directories.


A NetWare kernel module is referred to as a NetWare Loadable Module (NLM). NLMs are inserted into the NetWare kernel by means of the LOAD command, and removed by means of the UNLOAD command; the modules command lists currently loaded kernel modules. NLMs may reside in any valid search path assigned on the NetWare server, and they have .NLM as the file name extension.

Binary compatibility

Linux does not provide a stable API or ABI for kernel modules. This means that there are differences in internal structure and function between different kernel versions, which can cause compatibility problems. In an attempt to combat those problems, symbol versioning data is placed within the .modinfo section of loadable ELF modules. This versioning information can be compared with that of the running kernel before loading a module; if the versions are incompatible, the module will not be loaded.

Other operating systems, such as Solaris, FreeBSD, OS X, and Windows keep the kernel API and ABI relatively stable, thus avoiding this problem. For example, FreeBSD kernel modules compiled against kernel version 6.0 will work without recompilation on any other FreeBSD 6.x version, e.g. 6.4. However, they are not compatible with other major versions and must be recompiled for use with FreeBSD 7.x, as API and ABI compatibility is maintained only within a branch.


While loadable kernel modules are a convenient method of modifying the running kernel, this can be abused by attackers on a compromised system to prevent detection of their processes or files, allowing them to maintain control over the system. Many rootkits make use of LKMs in this way. Note that on most operating systems modules do not help privilege elevation in any way, as elevated privilege is required to load a LKM; they merely make it easier for the attacker to hide the break-in.[8]


Linux allows disabling module loading via sysctl option /proc/sys/kernel/modules_disabled.[9][10] An initramfs system may load specific modules needed for a machine at boot and then disable module loading. This makes the security very similar to a monolithic kernel. If an attacker can change the initramfs, they can change the kernel binary.


On OS X, a loadable kernel module in a kernel extension bundle can be loaded by non-root users if the OSBundleAllowUserLoad property is set to True in the bundle's property list.[11] However, if any of the files in the bundle, including the executable code file, are not owned by root and group wheel, or are writable by the group or "other", the attempt to load the kernel loadable module will fail.[12]

See also


  1. ^ "Kernel Extension Programming Topics: Introduction".  
  2. ^ "What Determines When a Driver Is Loaded".  
  3. ^ """The Linux Kernel Module Programming Guide, section 2.2 "Compiling Kernel Modules. Retrieved 2011-10-14. 
  4. ^ Linus Torvalds; et al. (2011-06-21). "Documentation/oops-tracing.txt". Retrieved 2011-10-03. 
  5. ^ Jonathan Corbet (2006-03-24). "Tainting from user space".  
  6. ^ "Novell support documentation: Tainted kernel". 2007-07-26. Retrieved 2011-10-03. 
  7. ^ Jonathan Corbet (April 27, 2004). "Being honest with MODULE_LICENSE". Retrieved October 30, 2012. 
  8. ^ Exploiting Loadable Kernel Modules
  9. ^ "Sysctl/kernel.txt". Retrieved January 4, 2013. 
  10. ^ Kees Cook (2012-11-28). "Clean module disabling". Retrieved 2013-12-12. 
  11. ^ "Info.plist Properties for Kernel Extensions".  
  12. ^  – Darwin and Mac OS X System Manager's Manual

External links

  • Anatomy of Linux loadable kernel modules, IBM DeveloperWorks, July 16, 2008, archived from the original on July 26, 2008
  • Online kext database for OSX / Hackintosh
  • Ori Pomerantz, Linux Kernel Module Programming Guide
  • Copyright Considerations With LKMs, 2008, archived from the original on June 20, 2008
  • "Kernel Extension Programming Topics" document for OS X
This article was sourced from Creative Commons Attribution-ShareAlike License; additional terms may apply. World Heritage Encyclopedia content is assembled from numerous content providers, Open Access Publishing, and in compliance with The Fair Access to Science and Technology Research Act (FASTR), Wikimedia Foundation, Inc., Public Library of Science, The Encyclopedia of Life, Open Book Publishers (OBP), PubMed, U.S. National Library of Medicine, National Center for Biotechnology Information, U.S. National Library of Medicine, National Institutes of Health (NIH), U.S. Department of Health & Human Services, and, which sources content from all federal, state, local, tribal, and territorial government publication portals (.gov, .mil, .edu). Funding for and content contributors is made possible from the U.S. Congress, E-Government Act of 2002.
Crowd sourced content that is contributed to World Heritage Encyclopedia is peer reviewed and edited by our editorial staff to ensure quality scholarly research articles.
By using this site, you agree to the Terms of Use and Privacy Policy. World Heritage Encyclopedia™ is a registered trademark of the World Public Library Association, a non-profit organization.

Copyright © World Library Foundation. All rights reserved. eBooks from Project Gutenberg are sponsored by the World Library Foundation,
a 501c(4) Member's Support Non-Profit Organization, and is NOT affiliated with any governmental agency or department.