Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 4 down vote favorite
1

When installing kernel modules, I have the option to strip out debugging symbols using INSTALL_MOD_STRIP=1. This saves significant disk space.

Does it also save memory? Why should one keep the debugging symbols in the kernel modules?

share|improve this question
When you're debugging them? – Kevin Jun 24 '12 at 22:47
@Kevin debugging can be done in several other ways, I do not really see a benefit from having the symbols in the modules if I never use (k)gdb on the kernel. – Lekensteyn Jun 25 '12 at 8:43

1 Answer

up vote 3 down vote accepted

Debugging symbols just add extra information to an executable that helps when running a debugger such as GDB. It lets the debugger recreate the source code from the executable to show you where things such as segfaults occur during runtime.

If you are testing / hacking / making something inter-operate with the module then you need them. During normal operation they just take up space and can pose a security risk on a production machine. For example if someone breaks into your system with user privileges they can use a debugger to look for weaknesses in the current running modules to gain root access.

It will save a small amount of space to remove them as well.

share|improve this answer
+1 for mentioning security concerns. – zxcdw Jun 24 '12 at 22:31
@zxcdw The security concerns are rather misguided. Most Linux kernel modules are open-source, so if the attacker wants to try things out, he can do it on his own machine. The exception is a driver for a device that's not easy to emulate, and even then it's a very minor concern, for which it's not at all clear to me that the cost/benefit is in favor of removing the symbols. (Cost = not having debugging messages if something goes wrong; benefit = an attacker with prolonged non-root access to the box and no source code access has a slightly easier time reverse-engineering the module.) – Gilles Jun 24 '12 at 23:55
If something goes wrong though you can always rmmod the one with out debugging symbols and modprobe one with the symbols. Maybe not in rare cases. It also makes the attacker's job easier as there could be system specific alterations in the module. For developing a module I can agree that they should be there but if it is used on a production machine they should not be included. Such as on a web server or otherwise. – Joe Jun 25 '12 at 0:30
I am familiar with gdb for "normal" programs. If I do not use (k)gdb, are the symbols in the kernel modules of any use? I mean, when a kernel module crashes, would I still get a call trace? – Lekensteyn Jun 25 '12 at 8:47
kernel.org/doc/htmldocs/kgdb.html – Joe Jun 25 '12 at 13:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.