Red Hat Linux Internals

Transcription

1 Red Hat Linux Internals Learn how the Linux kernel functions and start developing modules. Red Hat Linux internals teaches you all the fundamental requirements necessary to understand and start developing for the Linux kernel. Get deep into the internals of the Linux OS and begin to develop kernel modules for the latest Red Hat distribution. From kernel module implementation through memory and process management, which include I/O, debugging, and file system topics, this introductory course is all encompassing. Red Hat Linux Internals is designed to provide a solid foundation for those looking to start low level kernel development for this popular operating system. With the majority of the class being hands-on each student will be issued a laptop with all the necessary tools to learn the skills and essential methodologies required to be an Red Hat Linux developer. Attending students will learn: How to setup a development environment for Red Hat Linux How the Red Hat Linux kernel functions How to develop kernel modules for the Red Hat Linux operating system which interact with I/O, memory, processes, file systems, and networking Obfuscation methods used by attackers to escape detection Who should attend: Developers looking to get a grasp on Red Hat Linux kernel internals and development Individuals who have a solid understanding of low level Windows system programming and are looking to branch into the Linux OS Prerequisites: Experience in C programming Knowledge of systems programming in a UNIX or Linux environment (register-level hardware programming knowledge is recommended but not required) Familiarity with basic tools, such as vi, Emacs, and file utilities Familiarity with Unix development tools such as gcc and make Course Details: 5 Days M-F 70% Labs, 30% Lecture using the Red Hat distribution of Linux Laptops are provided during the class Students receive USB Flash drives of all programming exercises and labs Students receive Understanding the Linux Kernel Book

2 Day 1 Agenda Introduction Linux Versus Other Unix-Like Kernels Hardware Dependency Linux Versions Basic Operating System Concepts Review An Overview of the Linux Kernel Development Environment Setup Kernel Compilation Module Compilation Internal Kernel API s Kernel Modules Implementation Memory Memory Addressing Segmentation in Hardware Segmentation in Linux Memory Management of: Memory Areas, Page Frames, and Noncontiguous Memory Swapping Introduction Paging in Hardware Paging in RH Linux Processes Processes, Lightweight Processes, and Threads Process Descriptor Process Address Space (Creating/Deleting) Creating Processes Destroying Processes Process Management Process Scheduling: Algorithms & System Calls Process Switching Process Communication: Pipes, FIFO's and IPC Managing Kernel Threads No Labs for Intro Dev IDE Setup Compiling RedHat Kernel Compiling RedHat Kernel Module Our First Module Memory Addressing Memory Management Paging/Swapping Introduction Process Creation/Management Process Scheduling/Switching Process Communication Kernel Threading

3 Day 2 Agenda Interrupts and Exceptions The Role of Interrupt Signals Interrupts and Exceptions Nested Execution of Exception and Interrupt Handlers Initializing the Interrupt Descriptor Table Exception Handling in the Kernel Interrupt Handling in the Kernel Soft IRQs, Tasklets, and Bottom Halves Returning from Interrupts and Exceptions Kernel Synchronization Kernel Control Paths When Synchronization Is Not Necessary Synchronization Primitives Synchronizing Accesses to Kernel Data Structures Examples of Race Condition Prevention Timing Measurements Hardware Clocks Section The Linux Timekeeping Architecture CPU's Time Sharing Updating the Time and Date Updating System Statistics Software Timers System Calls Related to Timing Measurements Signals The Role of Signals Generating a Signal Delivering a Signal System Calls Related to Signal Handling System Calls POSIX APIs and System Calls System Call Handler and Service Routines Kernel Wrapper Routines Interrupts and Exceptions Nested Exception Handlers Resuming Code Execution from Interrupts and Exception Handlers Understanding Synchronization Understanding and Mitigating Race Conditions in the Linux Kernel Timekeeping Generating, Delivering and Handling Signals System Calls and Service Routines

4 Day 3 Agenda The Virtual Filesystem The Role of the Virtual Filesystem (VFS) VFS Data Structures Filesystem Types Filesystem Mounting Pathname Lookup Implementations of VFS System Calls File Locking Managing I/O Devices I/O Architecture Device Files Device Drivers Block Device Drivers Character Device Drivers Disk Caches The Page Cache The Buffer Cache Accessing Files Reading and Writing a File Memory Mapping Direct I/O Transfers Swapping: Methods for Freeing Memory What Is Swapping? Swap Area The Swap Cache Transferring Swap Pages Swapping Out Pages Swapping in Pages Reclaiming Page Frame The Ext2 and Ext3 Filesystems General Characteristics of Ext2 Ext2 Disk Data Structures Section Ext2 Memory Data Structures Section Creating the Ext2 Filesystem Section Ext2 Methods Section Managing Ext2 Disk Space Section The Ext3 Filesystem Understanding the VFS Block and Character Devices Disk Caching File Access Memory Mapping Understanding Swapping Ext2 FileSystem Ext3 FileSystem

5 Day 4 Agenda Program Execution Executable Files Executable Formats Execution Domains The exec Functions Executables Kernel Debugging Continuous Inspection Noncontinuous Inspection KGDB Debugger Execution Control Stack Frame Analysis Disassembly Register Dumps Target Manipulation Target Signal Catching Software Breakpoints Remote Debugging SystemTap Tracing Analysis Tapsets Networking Section Main Networking Data Structures System Calls Related to Networking Sending Packets to the Network Card Receiving Packets from the Network Card Module Implementation Linking and Unlinking Modules Linking Modules on Demand Module Loading ModProbe /proc/modules Unresolved Symbols SMP Symbols Module Licensing Debugging RH Kernel Using SystemTap SystemTap Scripting Networking Working with RH Linux Kernel Modules (LKM)

6 Day 5 Agenda Student Practical Demonstration: Using the tools, skills, and methodologies taught in Days 1 through 4 of the class students will derive the answers to questions regarding a Red Hat RootKit as a Linux Kernel Module. Each student will have to study how the RootKit works with the operating system to understand it s capabilities and persistence level as well as the threat level of the RootKit.