Look at the kernel, drivers and modules

$ run as a normal user# run as root (or with sudo)

Understand the role of the kernel

The kernel manages memory, CPU time, devices and file systems. Programs ask the kernel for everything through system calls. Most drivers are kernel modules that are loaded when needed.

$uname -r
6.12.0-55.9.1.el10_0.x86_64
$uname -a
$cat /proc/version

16.2

See kernel threads and drivers at work

The kernel runs its own threads (shown in [ ] in ps). Their names often show which driver or job they belong to.

$ps -ef | grep '\[' | head
$ps -o pid,cmd -p 2

16.3

Analyze what the kernel is doing

The kernel writes messages to a ring buffer: hardware found, drivers loaded, errors. Read it with dmesg or journalctl -k. /proc and /sys show live kernel data.

#dmesg | less
#dmesg -T --level=err,warn
#journalctl -k -b
$cat /proc/meminfo | head -5
$cat /proc/cmdline
$ls /sys/class/net/

Place	Shows
`dmesg`, `journalctl -k`	Kernel messages
`/proc/cpuinfo`, `/proc/meminfo`	CPU and memory details
`/proc/cmdline`	Boot options the kernel got
`/proc/PID/`	Data of each process
`/sys/`	Devices, drivers and their settings

Remember

dmesg -T shows human times. journalctl -k also works for earlier boots (-b -1) when the journal is persistent.

16.4

Understand hardware initialization

At boot the kernel finds hardware and loads drivers. Later, when you plug in a device, udev gets an event from the kernel, loads the right module and creates the device file in /dev.

#udevadm monitor
$udevadm info /dev/vdb
$ls /usr/lib/udev/rules.d/ /etc/udev/rules.d/

Note

Plug in a USB stick while udevadm monitor runs: you see the kernel and udev events one by one.

16.5

Manage kernel modules

Modules are driver files (.ko) in /lib/modules/$(uname -r)/. Load them with modprobe — it also loads the modules they depend on.

$lsmod | head
$lsmod | grep -i xfs
$modinfo xfs
#modprobe vfat
#modprobe -r vfat

Command	Does
`lsmod`	List loaded modules
`modinfo NAME`	Information and parameters of a module
`modprobe NAME`	Load a module with its dependencies
`modprobe -r NAME`	Unload a module (and unused dependencies)
`insmod`, `rmmod`	Load / unload one file (no dependencies; rarely used)

Load a module at every boot: put its name in a file in /etc/modules-load.d/.
```
#echo "vfat" > /etc/modules-load.d/vfat.conf
```
Block a module from loading (for example a protocol you never use).
/etc/modprobe.d/blacklist-usb-storage.conf
```
blacklist usb-storage
install usb-storage /bin/false
```

At work

Blocking usb-storage is a common hardening step: USB sticks then do not work on the server.

16.6

Check that hardware has a driver

List the devices and the driver ("Kernel driver in use") each one has.

$lspci -k
00:02.0 VGA compatible controller: Red Hat, Inc. Virtio 1.0 GPU (rev 01)
	Subsystem: Red Hat, Inc. Device 1100
	Kernel driver in use: virtio-pci
$lsusb
$lscpu
$lshw -short

Note

A device without "Kernel driver in use" has no working driver. Look for the module name in modinfo or the hardware vendor documentation.

16.7

Set module parameters

Many modules have parameters (options). Set them when loading, or for good in /etc/modprobe.d/.

$modinfo -p cdrom
$cat /sys/module/cdrom/parameters/lockdoor
#modprobe -r cdrom
#modprobe cdrom lockdoor=0

/etc/modprobe.d/cdrom.conf

options cdrom lockdoor=0

16.8

Change kernel settings with sysctl

Many kernel settings live in /proc/sys/. sysctl reads and changes them; files in /etc/sysctl.d/ make the changes permanent.

$sysctl net.ipv4.ip_forward
#sysctl -w net.ipv4.ip_forward=1
#echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/90-forward.conf
#sysctl --system
$sysctl -a | grep swappiness

At work

Common hardening settings: kernel.kptr_restrict = 2, kernel.dmesg_restrict = 1, net.ipv4.conf.all.accept_redirects = 0, net.ipv4.conf.all.rp_filter = 1.

16.9

Upgrade the kernel

A new kernel is installed next to the old ones, not over them. The boot menu lets you start an older kernel if the new one fails. By default RHEL keeps 3 kernels (installonly_limit=3 in /etc/dnf/dnf.conf).

#dnf upgrade -y kernel
$rpm -q kernel
#grubby --default-kernel
#grubby --info=ALL | grep -E '^(index|kernel|title)'
#dnf needs-restarting -r
#systemctl reboot

Exam tip

"Install the new kernel and make sure the system boots with it" = install with dnf (it becomes the default), reboot, check uname -r. To boot an older one by default: grubby --set-default /boot/vmlinuz-VERSION.

16.10

Remember the main points

The most important facts of this chapter, in short.

The kernel talks to the hardware and shares CPU, memory and devices between processes.
uname -r shows the kernel version; dmesg (or journalctl -k) shows kernel messages.
lspci, lsusb, lscpu and lsblk show hardware; udev makes device files in /dev.
Drivers are kernel modules: lsmod lists, modinfo shows details, modprobe NAME loads, modprobe -r NAME removes.
Load a module at boot with a file in /etc/modules-load.d/; set module options in /etc/modprobe.d/*.conf.
Kernel settings live in /proc/sys; change them now with sysctl -w, and for good in /etc/sysctl.d/*.conf (sysctl --system to load).
A new kernel comes with dnf update kernel; the old kernels stay, so you can boot an older one from GRUB.

16.11

Learn the key terms

The words of this chapter in simple English.

Term	Meaning
Kernel	The core of the operating system.
Kernel module	A part of the kernel that can be loaded when needed, often a driver.
Driver	Code that lets the kernel use one kind of hardware.
udev	The service that creates device files and handles new hardware.
/proc	A virtual file system with information from the kernel.
sysctl	A tool to read and set kernel settings in /proc/sys.
Kernel thread	Work the kernel does by itself, shown in [brackets] in ps.
initramfs	A small file system with drivers that the kernel loads first at boot.