Lion Cipher Lab
Write a Linux kernel module from scratch (and load it into a throwaway VM)
- Foundations
- Advanced
- ~90 min
- Free · no account required
Why it matters
Almost everything you have ever run is a user-space program: the kernel hands it a fenced-off sandbox, and when your program does something illegal — dereferences a null pointer, walks off the end of an array — the kernel simply kills that one process and the rest of the machine shrugs. A kernel module is the other side of that fence. It is code you compile and then splice directly into the running kernel, where it executes with FULL kernel privilege: it can touch any memory, talk to hardware, and there is no bigger adult in the room to catch its mistakes. That is exactly why device drivers,…
What you'll learn
- the user-space vs kernel-space boundary, felt by crossing it
- writing a loadable kernel module (LKM) in C with module_init/module_exit
- compiling against kernel headers with obj-m and a kbuild Makefile
- loading, inspecting, and unloading modules (insmod, rmmod, modprobe, lsmod, modinfo)
- reading kernel output from the ring buffer with dmesg / pr_info
- exposing a /proc entry so a module does something observable
- the security model of kernel code: privilege, tainting, module signing, Secure Boot/lockdown
Steps in this lab
- The boundary you are about to cross
- Why a throwaway VM, and nothing else
- Install the toolchain and the kernel headers
- Write the module: your first code in kernel space
- Write the Makefile that compiles against your kernel
- Compile it — and read what you got
- Load it, watch it, inspect it, unload it
- Make it DO something: a live /proc entry
- The security lens: privilege, tainting, signing, and lockdown
- What you built — and the reflex to keep