一、驱动编写

// kernel_protect.c - 最简版本 #include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h> static int __init protect_init(void) { printk(KERN_INFO "myapp_protect: 模块加载成功\n"); return 0; } static void __exit protect_exit(void) { printk(KERN_INFO "myapp_protect: 模块卸载\n"); } module_init(protect_init); module_exit(protect_exit); MODULE_LICENSE("GPL"); MODULE_AUTHOR("System Administrator"); MODULE_DESCRIPTION("保护模块测试"); MODULE_VERSION("1.0");

二、Makefile

# Makefile for kernel module obj-m += myapp_protect.o myapp_protect-objs := kernel_protect.o KERNEL_DIR ?= /lib/modules/$(shell uname -r)/build PWD := $(shell pwd) all: $(MAKE) -C $(KERNEL_DIR) M=$(PWD) modules clean: $(MAKE) -C $(KERNEL_DIR) M=$(PWD) clean install: cp myapp_protect.ko /lib/modules/$(shell uname -r)/extra/ depmod -a echo "myapp_protect" > /etc/modules-load.d/myapp-protect.conf echo "options myapp_protect protection_enabled=1 hide_module=1 log_violations=1" > /etc/modprobe.d/myapp-protect.conf modprobe myapp_protect systemctl restart systemd-modules-load uninstall: modprobe -r myapp_protect rm -f /lib/modules/$(shell uname -r)/extra/myapp_protect.ko rm -f /etc/modules-load.d/myapp-protect.conf rm -f /etc/modprobe.d/myapp-protect.conf depmod -a

三、测试：

# 生成驱动

$make

# 加载模块测试

$sudo insmod myapp_protect.ko

# 检查内核日志

$sudo dmesg | tail -n 5

# 卸载模块

$sudo rmmod myapp_protect.ko

# 再次检查日志

$sudo dmesg | tail -n 5