Unlocking Linux Kernel Secrets: Core Components, Modules, and Essential Commands

Linux kernel is an open‑source, Unix‑like monolithic kernel.

The Linux kernel is the core component of the Linux operating system, acting as the primary interface between hardware and processes, managing resources efficiently, and controlling all major hardware functions. Its main tasks are:

Memory management: tracking what memory stores which data and where.

Process management: deciding which processes can use the CPU, when, and for how long.

Device drivers: mediating between hardware and processes.

System calls and security: handling service requests from processes.

When properly implemented, the kernel operates invisibly to users in its own "kernel space," allocating memory and tracking storage locations, while user‑visible applications run in "user space" and interact with the kernel via the system call interface ( SCI).

1. Kernel Overview

The design follows a single‑kernel architecture while borrowing modular advantages from microkernels.

The kernel consists of several key parts: kernel Core kernel image, usually bzImage located in /boot as vmlinuz-VERSION-RELEASE. kernel object Kernel objects are stored under /lib/modules/VERSION-RELEASE/.

Configuration flags: [ ] → N – not compiled into the kernel. [M] – compiled as a loadable module. [*] – compiled directly into the kernel.

Auxiliary files ( ramdisk)

initrd

initramfs

2. Kernel Modules

2.1 uname Command

Usage uname [OPTION]... Options -n – display node name -r – display

VERSION-RELEASE

-s

– kernel name -v – kernel version -m – hardware name -i – hardware platform -p – processor type -o – operating system

# uname -m
i686

# uname -r
2.6.32-573.22.1.el6.i686

# uname -a
Linux MyServer 2.6.32-573.22.1.el6.i686 ... i686 i386 GNU/Linux

2.2 lsmod Command

Shows kernel modules currently loaded.

Definition

Data comes from /proc/modules.

Typical usage: lsmod | grep -i ext4 to check if a module is loaded.

# cat /proc/modules
iptable_filter 2173 0 - Live 0xed9b2000
ip_tables 9567 1 iptable_filter, Live 0xed9a9000
ext3 203718 1 - Live 0xed962000
jbd 65315 1 ext3, Live 0xed904000
xenfs 4360 1 - Live 0xed8e6000
ipv6 271097 14 - Live 0xed88e000
xen_netfront 15871 0 - Live 0xed7d9000
ext4 339812 2 - Live 0xed764000
jbd2 75927 1 ext4, Live 0xed6d9000
mbcache 6017 2 ext3,ext4, Live 0xed6b7000
xen_blkfront 19209 5 - Live 0xed69f000
...

# lsmod | grep ext4
ext4               339812  2
jbd2                75927  1 ext4
mbcache              6017  2 ext3,ext4

Fields

Column 1: module name

Column 2: module size

Column 3: number of dependent modules

Column 4: list of dependent modules

# lsmod
Module                  Size  Used by
iptable_filter          2173  0
ip_tables               9567  1 iptable_filter
ext3                  203718  1
jbd                    65315  1 ext3
xenfs                   4360  1
ipv6                  271097  14
xen_netfront           15871  0
ext4                  339812  2
jbd2                   75927  1 ext4
mbcache                6017  2 ext3,ext4
xen_blkfront           19209  5
...

2.3 modinfo Command

Displays detailed information about a kernel module.

Definition

Shows information for a module specified on the command line.

Can also query modules not currently installed.

If the module name is not a file, the search path is /lib/modules/VERSION, similar to modprobe.

Output format: fieldname : value.

Syntax modinfo [options] [modulename|filename...] Options -n – show only the module file path -p – show module parameters -a – author -d – description -l – license -0 – separate fields with '\0' instead of newlines (useful for scripts)

Examples

# modinfo ext4
filename:       /lib/modules/2.6.32-573.22.1.el6.i686/kernel/fs/ext4/ext4.ko
license:         GPL
description:    Fourth Extended Filesystem
author:         Remy Card, Stephen Tweedie, Andrew Morton, Andreas Dilger, Theodore and others
srcversion:      CB1B990F5A758DFB0FB12F1
depends:         mbcache,jbd2
vermagic:        2.6.32-573.22.1.el6.i686 SMP mod_unload modversions 686

# modinfo btrfs
filename:       /lib/modules/2.6.32-573.22.1.el6.i686/kernel/fs/btrfs/btrfs.ko
license:        GPL
alias:          devname:btrfs-control
alias:          char-major-10-234
srcversion:     B412C18B0F5BF7F1B3C941A
depends:        libcrc32c,zlib_deflate,lzo_compress,lzo_decompress
vermagic:       2.6.32-573.22.1.el6.i686 SMP mod_unload modversions 686

2.4 modprobe Command

Loads or unloads kernel modules.

Definition

Configuration files: /etc/modprobe.conf and /etc/modprobe.d/*.conf.

Handles dependencies using modules.dep (generated by depmod).

Syntax

modprobe [ -c ]

modprobe [ -l ] [ -t dirname ] [wildcard]

modprobe [ -r ] [ -v ] [ -n ] [ -i ] modulename …

Options -v – verbose output (useful for debugging). -C – reload configuration from /etc/modprobe.conf or /etc/modprobe.d. -c – print configuration and exit. -n – dry run (often combined with -v). -i – ignore install/remove directives from configuration files. -q – suppress error messages when a module cannot be found. -r – remove a module instead of inserting it. -f – force loading (dangerous, similar to --force-vermagic). -l – list all modules. -a – insert all modules specified on the command line. -t – force -l to show modules in a specific directory. -s – send error messages to syslog instead of stderr.

2.5 depmod Command

Generates module dependency files and system‑information mapping files.

Syntax depmod [-adeisvV] [-m <file>] [--help] [module_name] Parameters -a – analyze all available modules. -d – debug mode. -e – output unresolved symbols. -i – ignore version information in symbol tables. -m<file> – use a specific symbol table file. -s – record errors in system logs. -v – verbose output. -V – display version information. --help – show help.

2.6 insmod and rmmod Commands

Insert or remove a kernel module. Does not resolve dependencies; manual handling required.

insmod

Inserts a module file directly into the kernel.

Most users prefer modprobe because it handles dependencies.

Usage: insmod [filename] [module options...] rmmod

Removes a module from the kernel.

Typical usage: rmmod [modulename] or modprobe -r.

Options: -f – force removal (requires CONFIG_MODULE_FORCE_UNLOAD). -w – refuse to remove a module that is in use (isolates it). -s – send errors to syslog.

3. /proc Directory

The kernel exposes internal state, statistics, and configurable parameters through the proc pseudo‑filesystem.

Typical entries include cpuinfo, meminfo, modules, sysctl, and many others that can be inspected or modified.

3.1 sysctl Command

Syntax sysctl [options] [parameter] Options -n – print only the value. -e – ignore unknown keys. -N – print only the name. -w – write a new value. -p – load settings from /etc/sysctl.conf. -a – display all available parameters. -A – display all parameters in a table.

Typical usage

Set a parameter: sysctl -w parameter=VALUE Load from a config file: sysctl -p [/path/to/conf] Parameters can be read‑only (information only) or writable (configurable via /proc/sys).

4. /sys Directory

sysfs is a pseudo‑filesystem that presents attributes of hardware devices recognized by the kernel; many attributes are writable for tuning hardware behavior.

4.1 udev

Runs in user space and creates device nodes under /dev based on information from /sys.

Manages device addition/removal events and loads required firmware.

Rules are stored in /etc/udev/rules.d and /usr/lib/udev/rules.d.

4.2 Creating a ramdisk

Method 1 – mkinitrd

Recreate a ramdisk for the running kernel: mkinitrd /boot/initramfs-$(uname -r).img $(uname -r).

Method 2 – dracut

Alternative tool: dracut /boot/initramfs-$(uname -r).img $(uname -r).

4.3 Inspecting a ramdisk

# file /boot/initramfs-2.6.32-504.el6.x86_64.img
# gzip -d initramfs-2.6.32-504.el6.x86_64.img.gz
# cpio -id < ../initramfs-2.6.32-504.el6.x86_64.img
# cat init   # view the init script
# ls sbin   # list commands inside the ramdisk

5. Compiling the Kernel

5.1 Preparation

Install development tools (e.g., Server Platform Development, Development Tools on CentOS 6).

Gather hardware information ( cat /proc/cpuinfo, lspci, lsusb, lsblk, etc.).

Obtain the kernel source from www.kernel.org.

5.2 Simple Kernel Installation

Copy the current kernel configuration ( /boot/config-$(uname -r)) to .config in the source tree.

Run make menuconfig (or other config interfaces) to adjust options.

Compile with make -j$(nproc), then make modules_install and make install to install the kernel, modules, and generate initramfs.

5.3 Detailed Build Steps

Configuring options make config – command‑line questionnaire. make menuconfig – ncurses UI. make gconfig – GTK UI. make xconfig – Qt UI. make defconfig – use default configuration for the target platform. make allnoconfig – start with everything disabled.

Building

Compile the whole tree: make [-j N].

Compile a specific directory: make dir/.

Compile a single module: make dir/file.ko (e.g., make drivers/net/ethernet/intel/e1000/e1000.ko).

Cross‑compiling

Specify the target architecture: make ARCH=arch_name.

Get help for a specific architecture: make ARCH=arch_name help.

Rebuilding an existing source tree

Clean most generated files (keep config): make clean.

Remove all generated files and config: make mrproper.

Full clean including patches and backup files: make distclean.