Hacker News Reader

Comment by egberts1 | Hacker News Reader

Entry vector is via user-loadable kernel modules.

Does not work if kernel Kconfig setting has:

    CONFIG_MODULES=n

All deliverables should have this Kconfig setting disabled.

View on HN

> CONFIG_MODULES=n

does this work on normal linux desktops ? My impression was that either: 1). Kernel is too big. Try making modules - link error or 2) System will not boot due to missing/misconfigured parts.

The sole blocker of CONFIG_MODULES=n is WiFi and only just prior to network UP state of WiFi (during initial WiFi initialization).

Also, kernel build will fail during 'make modules'/'make all'/'make' but will succeed for 'make bzImage'/'make install'

Desktop Linux distros' WiFi required SIGNED module support for internationalization of radio band selection.

SO, for kernel modules to be disabled on desktop and still use WiFi, one needs to rebuild WiFi without module support and specifically to comply with their country's radio authority.

Pesky little thing.

Many embedded systems or supercomputers disable modules for security or simplicity, but then all needed drivers must be built in. WiFi is a common casualty because it’s normally modular due to firmware blobs provided as-is from WiFi manufacturers.

Also, many supercomputing facilities and hardened servers prohibits direct networking with WiFi drivers (because, unverifiable firmware blobs).

Your homelab should provide the direct Ethernet connect to your desktop.

Could always try:

echo 1 > /proc/sys/kernel/modules_disabled

Which is supposed to block dynamic loading modules until a reboot. =3

This is not permanent; if the system is rebooted, it will be undone :)

Kernel bootline can be uodated to include this option:

    modules_disabled

Reply on news.ycombinator.com