How to Audit Kernel Security with `kldstat` on FreeBSD Operating System

Introduction

FreeBSD is a robust and secure operating system widely used in servers, networking appliances, and embedded systems. Like any operating system, maintaining its security is crucial. Kernel security auditing helps prevent unauthorized access, detect vulnerabilities, and ensure system integrity. One of the essential tools for auditing kernel modules in FreeBSD is kldstat.

This article explores how to use kldstat to audit kernel security, detect unauthorized kernel modules, and ensure your FreeBSD system remains secure.

Understanding kldstat

The kldstat command is used in FreeBSD to display the status of kernel modules loaded into memory. Kernel modules are dynamically linked pieces of code that extend or modify kernel functionality without requiring a full system reboot.

Why Audit Kernel Modules?

Kernel modules have direct access to system hardware and resources, making them a potential security risk if left unchecked. Attackers may load malicious modules to escalate privileges or compromise system integrity. Regularly auditing kernel modules ensures that only trusted modules are running.

Installing and Using kldstat

Checking if kldstat is Installed

By default, kldstat is included in FreeBSD. You can verify its presence with:

which kldstat

If it returns a path, such as /sbin/kldstat, the tool is available.

Listing Loaded Kernel Modules

To display currently loaded kernel modules, use:

kldstat

This outputs information such as:

Id Refs Address            Size     Name
 1    1 0xffffffff80200000 2334540  kernel
 2    1 0xffffffff82434000 10b50    tmpfs.ko
 3    1 0xffffffff82445000 31e8     acpi.ko
 4    1 0xffffffff82449000 1430     uhid.ko

The output consists of:

• Id: A unique identifier for each loaded module.
• Refs: Number of references to the module.
• Address: The memory location of the module.
• Size: Module size in bytes.
• Name: The module’s filename.

Auditing Kernel Modules

To ensure system security, auditing the list of loaded modules is critical. Here’s how to assess module security:

1. Identify Unnecessary or Suspicious Modules

Compare the loaded modules against a list of expected modules for your FreeBSD system. Unrecognized modules could indicate unauthorized modifications or intrusions.

To see more details about a specific module, use:

kldstat -v -i <module_id>

For example:

kldstat -v -i 3

This provides verbose information about the module, including dependencies.

2. Cross-Check with Trusted Modules

Compare your loaded modules against FreeBSD’s official module repository or documentation. Use:

man 4 <module_name>

This displays official documentation on the module, explaining its function and necessity.

3. Check for Unauthorized Module Loading

To see when kernel modules were loaded, check system logs:

dmesg | grep kldload

This helps detect unauthorized module insertions. Additionally, the FreeBSD security audit logs may contain relevant entries:

tail -f /var/log/security

4. Verify Module Integrity

Malicious modules can be altered or replaced with harmful code. Use sha256 to verify a module’s integrity:

sha256 /boot/kernel/<module_name>.ko

Compare the checksum with a known good version.

5. Prevent Unauthorized Module Loading

If you detect suspicious modules, remove them immediately:

kldunload <module_name>

To prevent unauthorized modules from being loaded in the future, modify /boot/loader.conf or restrict kldload permissions:

echo 'kern_securelevel=2' >> /etc/sysctl.conf
sysctl kern.securelevel=2

A higher secure level prevents kernel module insertion or removal during runtime.

Hardening Kernel Security

To enhance security further:

1. Restrict Kernel Module Loading

Disable dynamic loading of kernel modules unless necessary:

echo 'kern.module_path=""' >> /etc/sysctl.conf
sysctl kern.module_path=""

This prevents the system from loading external kernel modules unless explicitly specified.

2. Enable Secure Levels

Setting a higher secure level prevents certain kernel modifications:

echo 'kern_securelevel=3' >> /etc/sysctl.conf
sysctl kern.securelevel=3

3. Use Mandatory Access Control (MAC)

FreeBSD provides MAC frameworks to restrict unauthorized kernel operations. Enable it in /boot/loader.conf:

mac_seeotheruids_load="YES"
mac_bsdextended_load="YES"

4. Monitor with Intrusion Detection Systems (IDS)

Consider using tools like AIDE (Advanced Intrusion Detection Environment) or OSSEC to monitor system integrity and detect unauthorized kernel modifications.

Automating Kernel Audits

To automate regular kernel module checks, create a cron job that alerts you when unknown modules are loaded.

Create a script (/usr/local/bin/audit_kldstat.sh):

#!/bin/sh
KNOWN_MODULES="kernel tmpfs.ko acpi.ko uhid.ko"
LOADED_MODULES=$(kldstat | awk '{print $NF}' | tail -n +2)

for module in $LOADED_MODULES; do
    echo "$KNOWN_MODULES" | grep -q "$module" || echo "[ALERT] Unknown module: $module" >> /var/log/kld_audit.log
done

Make it executable:

chmod +x /usr/local/bin/audit_kldstat.sh

Add it to crontab to run daily:

crontab -e

Add the following line:

0 3 * * * /usr/local/bin/audit_kldstat.sh

This runs the script at 3 AM daily and logs unknown modules to /var/log/kld_audit.log.

Conclusion

Auditing kernel security in FreeBSD using kldstat is crucial for maintaining a secure environment. By regularly checking loaded kernel modules, verifying their integrity, and enforcing strict policies, administrators can significantly reduce security risks. Implementing automated monitoring and secure-level enforcement further strengthens the system’s security posture.

By following these best practices, you can ensure that your FreeBSD system remains resistant to kernel-level attacks and unauthorized modifications.