LKRG - Linux Kernel Runtime Guard

BoerenkoolMetWorst · Jan 31, 2018

Linux Kernel Runtime Guard (LKRG) is a loadable kernel module that performs runtime integrity checking of the Linux kernel and detection of security vulnerability exploits against the kernel. As controversial as this concept is, LKRG attempts to post-detect and hopefully promptly respond to unauthorized modifications to the running Linux kernel (integrity checking) or to credentials (such as user IDs) of the running processes (exploit detection). For process credentials, LKRG attempts to detect the exploit and take action before the kernel would grant the process access (such as open a file) based on the unauthorized credentials.
Click to expand...

http://www.openwall.com/lkrg/

142395 · Jan 31, 2018

Can it be good addition to Hardened-Linux patch after GRsecurity went private?
Anyway I'll wait until the project mature.

BoerenkoolMetWorst · Jul 23, 2018

LKRG Under The Hood presentation slides:
http://www.openwall.com/presentations/CONFidence2018-LKRG-Under-The-Hood/

BoerenkoolMetWorst · Nov 16, 2020

A recent big update:
https://www.phoronix.com/scan.php?page=news_item&px=Linux-LKRG-0.8-Released

Updated presentation for 2020:
https://www.openwall.com/presentations/OSTconf2020-LKRG-In-A-Nutshell/

BoerenkoolMetWorst · Sep 7, 2021

LKRG 0.9.0 is out, with support for new Linux kernels, optionally building LKRG in kernel tree, Continuous Integration (boot tests in VMs, including with Ubuntu's daily updated mainline kernels), and much more.
https://www.openwall.com/lists/announce/2021/04/12/1

LKRG 0.9.1 is out, addressing various issues reported against the 0.9.0 release.
https://www.openwall.com/lists/announce/2021/04/27/1

BoerenkoolMetWorst · May 12, 2022

LKRG 0.9.3 was released April 21.

The following major changes have been made between LKRG 0.9.2 and 0.9.3:

*) Support new mainline kernels 5.17.x, 5.18-rc*, and hopefully beyond
*) Support loading into Xen PV guest kernels even on older CPUs without UMIP
*) Fix build on latest CentOS Stream 8 and upcoming RHEL 8.6+
*) Fix build on CentOS Stream 9
*) Fix build on openSUSE Leap
*) Continuous Integration and debugging build updates and improvements
Click to expand...

The following major changes have been made between LKRG 0.9.1 and 0.9.2:

*) Support new stable and mainline kernels 5.14 to at least 5.16-rc*
*) Support new longterm kernels 5.4.118+, 4.19.191+, 4.14.233+
*) Support various CONFIG_SECCOMP configurations
*) Fix a false positive possible because of race on SECCOMP_FILTER_FLAG_TSYNC
where LKRG started to validate other threads' seccomp state too early
*) Fix support of CONFIG_HAVE_STATIC_CALL on Linux 5.10+ to avoid a race with
unloading of other modules
*) Support the "nolkrg" kernel parameter in LKRG itself (not only in systemd)
*) Log the blocked module name when lkrg.block_modules=1
*) Install/expect the sysctl settings in /etc/sysctl.d/01-lkrg.conf
*) Add dkms.conf
*) Continuous Integration and debugging build updates and improvements
Click to expand...

New website:
https://lkrg.org/

BoerenkoolMetWorst · Sep 23, 2025 at 3:51 AM

LKRG 1.0 is finally released:

At over 7 years since its initial public release in 2018, we're finally
ready to call this project mature.

We've just released LKRG 1.0.0, available on the LKRG project website:

https://lkrg.org

The following major changes have been made between LKRG 0.9.9 and 1.0.0:

*) Support latest mainline Linux kernels, currently tested up to 6.17-rc4
*) Support Linux 6.13+ by not hooking {override,revert}_creds() anymore, and
limiting detection of cred pointer overwrite attacks on those kernels
*) To compensate for the above and as an enhancement on older kernels, check
for cred pointer overwrites in certain other places where we did not before
*) Do not track those credentials that we currently do not validate anyway,
and do not hook kernel functions that would only update such credentials
(shrunk the codebase by approximately 1500 lines)
*) Support OverlayFS ovl_tmpfile introduced in Linux 6.10 (such support was
needed to avoid false positives with containers on 6.10 to 6.12.y), but
don't hook anything OverlayFS on 6.13+ (is unneeded there)
*) Support (or rather be compatible with the kernel's use of) Intel CET IBT
(CONFIG_X86_KERNEL_IBT) and/or KCFI (CONFIG_CFI_CLANG) for now on x86_64
*) Support clang in more cases (fix some of the portability issues), but for
now continue to only support GCC officially
*) Switch many hooks from kretprobes to simple kprobes for greater reliability
and improved performance, and also reduce source code duplication in how
hooks are installed (approximately +650 -1550 lines, so -900 lines overall)
*) Overhaul locking of per-task shadow data, using finer-grain locks
*) Improve performance of per-task shadow data lookups by making them lockless
*) Wrap integrity violation checks in unlikely(), so that the cold attack
response code doesn't clutter caches in the hot paths
*) Fix several lethal race conditions involving SECCOMP_FILTER_FLAG_TSYNC
*) Fix false positive "seccomp mode corruption" involving SECCOMP_MODE_DEAD
(was possible on 5.17+ and stable/longterm kernels that backported this)
*) Fix integrity violation misattribution to a wrong task when pint_enforce=0
*) Fix several integrity violation race conditions when pint_enforce=0
*) Fix race condition (possible NULL dereference) with namespace validation
*) Fix race condition on msr_validate sysctl changes as well as on transitions
between profile_validate=4 and others
*) Fix various other bugs that typically had no externally visible effect
*) Make kprobes testing via LKRG's own dummy function hooking optional (works
around issue seen on recent Gentoo) and improve reporting of failures
*) Build and link the userspace logger tools with hardening flags, and pass
distributions' RPM packaging hardening flags to the compiler and linker
*) lkrg-logctl: Support and report continuation lines (an extra one-character
field indicating whether the line is a new message or a continuation)
*) lkrg-logger: Make logs group-readable
*) Continuous Integration: switch from Ubuntu to Fedora for latest mainline
kernel boot test, add Ubuntu 24.04, 24.10, 25.04, 25.10 boot tests, repair
CentOS 7 build test to survive this distro's EOL and GitHub's deprecation
Click to expand...

https://www.openwall.com/lists/announce/2025/09/02/1

Talk with slides from Nullcon Berlin 2025:
https://www.openwall.com/presentations/NullconBerlin2025-LKRG/

Log in or Sign up

LKRG - Linux Kernel Runtime Guard

BoerenkoolMetWorst Registered Member

142395 Guest

BoerenkoolMetWorst Registered Member

BoerenkoolMetWorst Registered Member

BoerenkoolMetWorst Registered Member

BoerenkoolMetWorst Registered Member

BoerenkoolMetWorst Registered Member

Log in or Sign up

LKRG - Linux Kernel Runtime Guard

BoerenkoolMetWorst Registered Member

142395 Guest

BoerenkoolMetWorst Registered Member

BoerenkoolMetWorst Registered Member

BoerenkoolMetWorst Registered Member

BoerenkoolMetWorst Registered Member

BoerenkoolMetWorst Registered Member

Useful Searches