Linux Kernel Runtime Guard (LKRG) for Debian, Whonix, Qubes, Kicksecure

Introduction

LKRG is Freedom Software / Open Source.

The focus of this wiki page is to provide simplified user documentation and easy installation of LKRG in Debian, Kicksecure, Qubes, Whonix, and perhaps Debian-based Linux distributions. Installable from an APT repository.

This is a lightweight software fork ^[archive] and no changes will be made to the core of LKRG. Links to the official LKRG homepage ^[archive] and other original resources can be found here.

Download

FREE

LKRG Overview

This is only a very brief introduction, since LKRG technical details are not the focus of this page. Quote official LKRG homepage ^[archive]:

LKRG performs runtime integrity checking of the Linux kernel and detection of security vulnerability exploits against the kernel.

As controversial as this concept is, LKRG attempts to post-detect and hopefully promptly respond to unauthorized modifications to the running Linux kernel (integrity checking) or to credentials such as user IDs of the running processes (exploit detection). For process credentials, LKRG attempts to detect the exploit and take action before the kernel would grant access (such as open a file) based on the unauthorized credentials.

LKRG defeats many pre-existing exploits of Linux kernel vulnerabilities, and will likely defeat many future exploits (including of yet unknown vulnerabilities) that do not specifically attempt to bypass LKRG. While LKRG is bypassable by design, such bypasses tend to require more complicated and/or less reliable exploits.

To learn more about LKRG, interested readers can:

• review the official LKRG homepage ^[archive]
• watch the LKRG Presentation Video ^[archive] or LKRG Presentation Slides ^[archive]
• read the LKRG Wiki ^[archive]
• LKRG rootkit detection ^[archive]
• consult other Upstream Resources
• LKRG is also mentioned in Master's Thesis Effectiveness of Linux Rootkit Detection Tools ^[archive]

Performance Impact

Quote LKRG upstream:

No benchmarks have yet been performed, but it appears the performance penalty is around 2.5% for fully enabled LKRG.

Quote Phoronix.com ^[archive], Benchmarking The Performance Overhead To The Linux Kernel Runtime Guard ^[archive] (page 5 ^[archive]), Michael Larabel ^[archive] (code added):

Out of 90 benchmarks run comparing the performance hit on this Intel Core i9 9900KS from LKRG, having LKRG enabled led to around a 5% hit based on the geometric mean of all tests carried out. Granted, some real-world workloads like code compilation speed were impacted much more dramatically while test cases not involving I/O or other kernel operations tended to see no measurable difference in run-time performance.

See the full article Benchmarking The Performance Overhead To The Linux Kernel Runtime Guard ^[archive] for a detailed benchmark.

LKRG Free vs LKRG Pro

Whonix ™ developer Patrick Schleizer said ^[archive]:

Contacted upstream LKRG developers privately. To paraphrase: "We don’t oppose you packaging it. As long as LKRG exists, there will always be a free and libre version. There is no pro version yet. A hypothetical future pro version would not change that." In my words: "there won’t be a grsecurity alike situation where everything gets closed down".

Quote LKRG wiki ^[archive]:

We will likely use GPLv2 at least for LKRG free. We might or might not use a different license for LKRG Pro, if we ever make it.

Users who benefit from LKRG Free are encouraged to support its further development. However, at the time of writing they are not accepting donations:

We used to accept donations for LKRG via Patreon, but we currently don't. Some of our former supporters are listed in the PATREON file in LKRG distribution tarballs.

Installation

Testers only!

Note: Users who require better security can Build the Linux Kernel Runtime Guard (LKRG) Debian Package from Source Code and verify software signatures before installation.

Logo	Host Operating System	Installation Instructions	Note
	Debian hosts	Follow the instructions below to install from the Whonix ™ repository.	Do not install LKRG on a Debian host if intending to run VirtualBox (such as Whonix ™) virtual machines (VMs) due to this known bug [archive]. LKRG can be installed inside VirtualBox guest VMs.
	Non-Qubes-Whonix ™	Follow the installation instructions below.	In Whonix ™, skip the following "Add Whonix ™ repository" step since it is already enabled by default.
	Qubes OS [archive] Debian based VMs	Follow these LKRG Qubes instructions.	See footnote.
	Qubes-Whonix ™	Follow these LKRG Qubes-Whonix ™ instructions.	See footnote.
	Other Linux distributions	LKRG is available for most Linux distributions.	Follow the installation instructions for non-Debian distributions on the official LKRG homepage [archive].

Add Whonix ™ repository.

1. Download the Signing Key.

wget https://www.whonix.org/patrick.asc

wget https://www.whonix.org/patrick.asc

2. Optional: Check the Signing Key for better security.

3. Add Whonix's signing key.

sudo apt-key --keyring /etc/apt/trusted.gpg.d/whonix.gpg add ~/patrick.asc

sudo apt-key --keyring /etc/apt/trusted.gpg.d/whonix.gpg add ~/patrick.asc

4. Add Whonix's APT repository.

echo "deb https://deb.whonix.org buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/whonix.list

echo "deb https://deb.whonix.org buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/whonix.list

Install LKRG.

1. Update the package lists.

sudo apt-get update

sudo apt-get update

2. Install LKRG.

sudo apt-get install lkrg linux-headers-amd64

sudo apt-get install lkrg linux-headers-amd64

The LKRG installation is complete.

It is recommended to review optional hardening and other entries below, but this is not required.

Configuration

It might be possible to further improve the security provided by LKRG though LKRG configuration, but this can potentially lead to decreased system stability. Please refer to upstream sysctl configuration documentation ^[archive] chapter Runtime configuration.

Whonix specific LKRG Configuration Tips

Warning:

These configuration sysctl might be outdated. Please refer to upstream sysctl configuration documentation ^[archive] chapter Runtime configuration.

Note: All the possible configuration changes in this section are optional.

Table: Whonix specific LKRG Configuration Tips

Category	Instructions
Block Module Loading	Users which use lkrg.block_modules in Whonix ™ would also have to follow Whonix ™ instructions on module loading.
View Current Runtime Configuration	To view the current configuration, run. sudo sysctl -a | grep lkrg sudo sysctl -a | grep lkrg Refer to upstream readme [archive] chapter Runtime configuration.
Temporary Runtime Configuration Changes	To temporarily change configuration settings until next reboot, run. Note: Replace lkrg.profile_enforce=3 with the actual sysctl setting you like to change as per upstream documentation. sudo sysctl -w lkrg.profile_enforce=3 sudo sysctl -w lkrg.profile_enforce=3
Persistent Configuration Changes	To enable any (LKRG) sysctl persistently after reboot. Open file /etc/sysctl.d/50_user.conf in an editor with root rights. (Qubes-Whonix ™: In TemplateVM) This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link. sudoedit /etc/sysctl.d/50_user.conf sudoedit /etc/sysctl.d/50_user.conf Paste (LKRG) sysctl settings such as. Note: Replace lkrg.profile_enforce=3 with the actual sysctl setting you like to change as per upstream documentation. lkrg.profile_enforce=3 lkrg.profile_enforce=3 Save. The procedure of persistently changing sysctl settings is complete.
Hardening - UMH Validation and Enforcement	Better do not use lkrg.umh_validate=2 for now. Might break Whonix Firewall. Advanced users could refer to upstream documentation on lkrg.umh_validate and lkrg.umh_enforce.

Usage

Once LKRG has been installed, little effort is required since it will protect the kernel without the user's knowledge and/or interaction. However, it is sensible to check that LKRG is running correctly and to monitor system logs for any suspicious entries. Check this entry at a later date for any additional recommendations.

To check systemd journal log for kernel messages by LKRG, run.

sudo journalctl -b | grep lkrg

sudo journalctl -b | grep lkrg

To keep watching systemd journal log for new LKRG messages, run.

sudo journalctl -b -f | grep lkrg

sudo journalctl -b -f | grep lkrg

At this stage a graphical user interface (GUI) is not provided that can proactively inform users who fail to analyze the systemd journal log for relevant LKRG messages. A GUI or popup notification might be developed later on -- help is most welcome.

Recovery

Quote upstream readme.

To account for the hopefully unlikely but really unfortunate event that some incompatibility between the Linux kernel or other components of the system and LKRG isn't detected prior to LKRG installation yet leads to system crash on bootup, we've included support for the "nolkrg" kernel parameter in the systemd unit file for LKRG. Thus, if you've followed the above installation procedure for LKRG with systemd, you may disable LKRG by specifying "nolkrg" on the kernel command-line via your bootloader. The system should then boot up without LKRG, and thus without triggering the problem, letting you fix it.

Debugging

linux-image

dpkg -l | grep linux-image

dpkg -l | grep linux-image

Should include:

ii  linux-image-4.19.0-6-amd64                    4.19.67-2+deb10u2               amd64        Linux 4.19 for 64-bit PCs (signed)
ii  linux-image-amd64

linux-headers

dpkg -l | grep linux-head

dpkg -l | grep linux-head

Should include:

ii  linux-headers-4.19.0-6-amd64                  4.19.67-2+deb10u2               amd64        Header files for Linux 4.19.0-6-amd64
ii  linux-headers-4.19.0-6-common                 4.19.67-2+deb10u2               all          Common header files for Linux 4.19.0-6
ii  linux-headers-amd64 

modinfo

sudo modinfo p_lkrg

sudo modinfo p_lkrg

filename:       /lib/modules/4.19.0-6-amd64/updates/dkms/p_lkrg.ko
license:        GPL v2
description:    pi3's Linux kernel Runtime Guard
author:         Adam 'pi3' Zabrocki (http://pi3.com.pl)
depends:        usbcore
retpoline:      Y
name:           p_lkrg
vermagic:       4.19.0-6-amd64 SMP mod_unload modversions 
parm:           p_init_log_level:Logging level init value [1 (alive) is default] (uint)

dkms status

sudo dkms status

sudo dkms status

Should include:

lkrg, 0.7, 4.19.0-6-amd64, x86_64: installed

Additional Resources

Forum Discussion

• Linux Kernel Runtime Guard (LKRG) - Linux Kernel Runtime Integrity Checking and Exploit Detection ^[archive]

Upstream Resources

• LKRG Website ^[archive]
• LKRG Source Code git Repository ^[archive]
• LKRG Presentation Video ^[archive]
• Old LKRG Presentation Slides CONFidence 2018 ^[archive]
• Updated LKRG Presentation Slides OSTconf 2020 ^[archive]
• LKRG Threat Model ^[archive]
• LKRG Mailing List ^[archive]
• LKRG Wiki ^[archive]
• https://www.openwall.com/lists/lkrg-users/2020/02/28/1 ^[archive]

Upstream Mailing List Discussions

• LKRG compilation hardening flags, checksec, hardening-check ^[archive]
• LKRG packagers / downstream wishlist ^[archive] (signed git commits, signed git tags, version numbers, logo)
• module loading / systemd bug report / suggestion ^[archive]
• LKRG kills VirtualBox host VMs ^[archive]
• announcement of this LKRG Debian package on upstream LKRG mailing list ^[archive]
• LKRG module parameters ^[archive]
• Compiling LKRG static into the Kernel / Loading LKRG kernel module as early as possible or after other modules? ^[archive]

See Also

• security-misc ^[archive]: Inspired by the Kernel Self Protection Project (KSPP ^[archive]). This package implements most if not all recommended Linux kernel settings (sysctl) and kernel parameters set by the KSPP.
• Hardened Malloc ^[archive]: A hardened memory allocator which can be used with many applications to increase security.
• grub-live ^[archive]: Boot your existing, installed Debian Host into Live Mode.
• Hardened VM Kernel ^[archive] (in development): A hardened kernel configuration optimized for virtual machines, see: development discussion ^[archive].
• System Hardening Checklist
• SecBrowser ™: A Security-hardened, Non-anonymous Browser

References

---

Whonix ™ is Supported by Evolution Host DDoS Protected VPS. Stay private and get your VPS with Bitcoin or Monero.

---

Jobs in USA

---

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki

---

Follow:

Support:

Donate:

Are you proficient with iptables? Want to contribute? Check out possible improvements to iptables. Please come and introduce yourself in the development forum.

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.

Copyright (C) 2012 - 2021 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee ^[archive] of the Open Invention Network ^[archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.

Whonix ™ is a derivative of and not affiliated with Debian ^[archive]. Debian is a registered trademark ^[archive] owned by Software in the Public Interest, Inc ^[archive].

Whonix ™ is produced independently from the Tor® ^[archive] anonymity software and carries no guarantee from The Tor Project ^[archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint, Contact.