lkm-hidden
lkm-hidden copied to clipboard
/proc/sys/kernel/tainted
If you load this module, /proc/sys/kernel/tainted
will have bits masks set and you will get a pretty message in dmesg
:
[ 62.037165] example: loading out-of-tree module taints kernel.
[ 62.037234] example: module verification failed: signature and/or required key missing - tainting kernel
Whilst it's not a complete giveaway.
- The module (
example
) is visible above. - Since the tainted module is hidden, the tainted flag indicates that a module is potentially hiding.