search

lkrg-org / lkrg

Linux Kernel Runtime Guard
https://lkrg.org
Other
410 stars 72 forks source link

Setting/unsetting lkrg.hide makes the module appear "in use" and not removable #281

Open solardiz opened 1 year ago

solardiz commented 1 year ago

After these two commands:

sysctl lkrg.hide=1
sysctl lkrg.hide=0

lkrg is correctly seen in lsmod again (between the commands, it correctly is not), but with -2 in the column showing how many other modules use it. In that state, rmmod lkrg refuses to remove it saying rmmod: ERROR: Module lkrg is in use, but rmmod -f lkrg works fine.

In a separate test (not trying to unload the module yet), repeating the sysctl commands doesn't appear to change the usage count further (it's still at -2 after two more commands like this).

Adam-pi3 commented 1 year ago

Yes, it was from the beginning of that feature. I'm not exactly sure why, but it is related to KOBJs which we clear and recreate. I don't see any issues with such behavior. rmmod -f is doing all the work fine and -2 is probably a confusion for the kernel of loosing the track of original KOBJs which now appeared again. However, I never go through the details of it.