Quais tipos de ELF tem o próprio kernel e módulos do kernel?

Question

link diz

The type field tells us what the purpose of the file is. There are a few common file types.

CORE (value 4)
DYN (Shared object file), for libraries (value 3)
EXEC (Executable file), for binaries (value 2)
REL (Relocatable file), before linked into an executable file (value 1)

...

A common misconception is that ELF files are just for binaries or executables. We already have seen they can be used for partial pieces (object code). Another example is shared libraries or even core dumps (those core or a.out files). The ELF specification is also used on Linux for the kernel itself and Linux kernel modules.

Quais tipos de ELF tem o próprio kernel e os módulos do kernel?

Você poderia dar alguns exemplos dos arquivos do próprio kernel e módulos do kernel, para eu experimentar com file ? Estou usando o Ubuntu 18.04.

Obrigado.

    

Answer 1

Você pode descobrir:

Para módulos, procurando em /lib/modules/$(uname -r)/kernel/.../*.ko :

$ file xfs.ko 
xfs.ko: ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), BuildID[sha1]=bcb5e287509cedbb0c5ece383e0b97fb99e4781e, not stripped

$ readelf -h xfs.ko 
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              REL (Relocatable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0x0
  Start of program headers:          0 (bytes into file)
  Start of section headers:          1829088 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           0 (bytes)
  Number of program headers:         0
  Size of section headers:           64 (bytes)
  Number of section headers:         45
  Section header string table index: 44

Para o kernel, uma maneira fácil é compilando um e olhando para o vmlinux:

$ file vmlinux
vmlinux: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=eaf006a7ccfedbc40a6feddb04088bdb2ef0112f, with debug_info, not stripped

$ readelf -h vmlinux
ELF Header:
  Magic:   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
  Class:                             ELF64
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              EXEC (Executable file)
  Machine:                           Advanced Micro Devices X86-64
  Version:                           0x1
  Entry point address:               0x1000000
  Start of program headers:          64 (bytes into file)
  Start of section headers:          171602920 (bytes into file)
  Flags:                             0x0
  Size of this header:               64 (bytes)
  Size of program headers:           56 (bytes)
  Number of program headers:         5
  Size of section headers:           64 (bytes)
  Number of section headers:         43
  Section header string table index: 42

    

Answer 2

Com a maioria das distribuições Linux, o kernel é armazenado em /boot como uma bzImage compactada. Isso pode ser descompactado usando o script extract-vmlinux (fornecido pelo pacote linux-headers nos sistemas Ubuntu). Com o Ubuntu 16.04, eu posso determinar o tipo ELF para o kernel 4.4.0 executando os seguintes comandos:

$ sudo /usr/src/linux-headers-4.4.0-127/scripts/extract-vmlinux /boot/vmlinuz-4.4.0-127-generic > /tmp/vmlinux &&
readelf -h /tmp/vmlinux | grep Type

Type:                              EXEC (Executable file)