Actions

Linux Kernel Runtime Guard (LKRG)

From Whonix

Introduction[edit]

LKRG is Freedom Software / Open Source. [1]

The focus of this wiki page is to provide simplified user documentation and easy installation of LKRG in Debian, Kicksecure, Qubes, Whonix, and perhaps Debian-based Linux distributions. This is a lightweight software fork [archive] and no changes will be made to the core of LKRG. Packaging is only provided for Debian. Links to the official LKRG homepage [archive] and other original resources can be found here.

Download[edit]

LKRG logo Debian.png Whonix old logo.png Qubes-logo-blue.png Tux.png FREE Download LKRG

LKRG Overview[edit]

This is only a very brief introduction, since LKRG technical details are not the focus of this page.

Linux Kernel Runtime Guard (LKRG) is a loadable kernel module that performs runtime integrity checking of the Linux kernel and detection of security vulnerability exploits against the kernel. As controversial as this concept is, LKRG attempts to post-detect and hopefully promptly respond to unauthorized modifications to the running Linux kernel (integrity checking) or to credentials (such as user IDs) of the running processes (exploit detection). For process credentials, LKRG attempts to detect the exploit and take action before the kernel would grant the process access (such as open a file) based on the unauthorized credentials. [2]

The Linux Kernel Runtime Guard protects system by comparing hashes which are calculated from the most important kernel region / sections / structures with the internal database hashes. Additionally, special efforts have been made to individually protect all extensions of the kernel (modules). To make the project fully functional, the module should be initially loaded on a clean system – e.g. directly after installation or after booting clean system. At this moment it is possible to create a trusted database of hashes. [3]

To learn more about LKRG, interested readers can:

Performance Impact[edit]

No benchmarks have yet been performed, but it appears the performance penalty is around 2.5% for fully enabled LKRG. [2]

LKRG Free vs LKRG Pro[edit]

Whonix ™ developer Patrick Schleizer said [archive]:

Contacted upstream LKRG developers privately. To paraphrase: "We don’t oppose you packaging it. As long as LKRG exists, there will always be a free and libre version. There is no pro version yet. A hypothetical future pro version would not change that." In my words: "there won’t be a grsecurity alike situation where everything gets closed down".

Quote LKRG wiki [archive]:

We will likely use GPLv2 at least for LKRG free. We might or might not use a different license for LKRG Pro, if we ever make it.

Users who benefit from LKRG Free are encouraged to support its further development. However, at the time of writing they are not accepting donations: [4]

We used to accept donations for LKRG via Patreon, but we currently don't. Some of our former supporters are listed in the PATREON file in LKRG distribution tarballs.

Installation[edit]

Testers only! Testers only!

Note: Users who require better security can Build the Linux Kernel Runtime Guard (LKRG) Debian Package from Source Code and verify software signatures before installation.

Logo Host Operating System Installation Instructions Note
Debian.png Debian hosts Follow the instructions below to install from the Whonix ™ repository. [5] Do not install LKRG on a Debian host if intending to run VirtualBox (such as Whonix ™) virtual machines (VMs) due to this known bug [archive]. LKRG can be installed inside VirtualBox guest VMs.
Whonix old logo.png Non-Qubes-Whonix ™ Follow the installation instructions below. In Whonix ™, skip the following "Add Whonix ™ repository" step since it is already enabled by default.
Qubes-logo-blue.png Qubes OS [archive] Debian based VMs Follow these LKRG Qubes instructions. See footnote. [6]
Qubes-logo-blue.png Whonix old logo.png Qubes-Whonix ™ Follow these LKRG Qubes-Whonix ™ instructions. See footnote. [6]
Tux.png Other Linux distributions LKRG is available for most Linux distributions. Follow the installation instructions for non-Debian distributions on the official LKRG homepage [archive].

Add Whonix ™ repository.

A) Download the Signing Key.

wget https://www.whonix.org/patrick.asc

B) Optional: Check the Signing Key for better security.

C) Add Whonix's signing key.

sudo apt-key --keyring /etc/apt/trusted.gpg.d/whonix.gpg add ~/patrick.asc

D) Add Whonix's APT repository.

echo "deb https://deb.whonix.org buster main contrib non-free" | sudo tee /etc/apt/sources.list.d/whonix.list

Install LKRG.

1. Update the package lists.

sudo apt-get update

2. Install LKRG. [7]

sudo apt-get install lkrg linux-headers-amd64

The LKRG installation is complete. [8]

It is recommended to review optional hardening and other entries below, but this is not required.

Configuration[edit]

Note: All the possible configuration changes in this section are optional.

Legend: [9]

  • CI - Code Integrity
  • ED - Exploit Detection

Table: LKRG Configuration Options

Category Instructions
Basics All sysctl configuration options can be found here [archive].
Block Module Loading Advanced users can block module functionality (lkrg.block_modules) with one of the following settings:
  • 0 - do NOT lock the kernel and allow to load kernel module
  • 1 - lock the kernel and do NOT allow to load kernel module

See also: module loading.

Current Configuration To view the current configuration, run.

sudo sysctl -a | grep lkrg

Hardening - CI Panic - Crash Kernel when Code Integrity Violation It is possible to further improve the security provided by LKRG, but this can potentially lead to decreased system stability. Users that are willing to make this trade-off can opt-in to the following setting. LKRG developers have not enabled the following sysctl option by default since it can result in kernel panics and system crashes, or occasional false positives (integrity violations and/or exploits are detected when they don't really exist). See the LKRG homepage [archive]. This might be the reason why LKRG developers did not yet enable kernel panic on CI failure by default.

Kernel panic on code integrity CI failure (lkrg.ci_panic) - two options are available:

  • 0 - do NOT crash the kernel on CI failure (default)
  • 1 - crash the kernel (call panic()) on CI failure

The following command enables kernel panic on CI failure non-persistently until reboot.

sudo sysctl -w lkrg.force_run=1

The following procedure enables this feature persistently after reboot.

Open file /etc/sysctl.d/50_user.conf in an editor with root rights.

(Qubes-Whonix ™: In TemplateVM)

This box uses sudoedit for better security [archive]. This is an example and other tools could also achieve the same goal. If this example does not work for you or if you are not using Whonix, please refer to this link.

sudoedit /etc/sysctl.d/50_user.conf

Paste.

lkrg.ci_panic=1

Save.

The procedure of enabling CI panic is complete.

Hardening - UMH Lock Better do not use for now. Breaks Whonix Firewall. [10]
Hide LKRG Attempts to hide LKRG will not work because this feature is not yet functional; LKRG will still be detected. [11] [12] [13]

Usage[edit]

Once LKRG has been installed, little effort is required since it will protect the kernel without the user's knowledge and/or interaction. However, it is sensible to check that LKRG is running correctly and to monitor system logs for any suspicious entries. Check this entry at a later date for any additional recommendations.

To check systemd journal log for kernel messages by LKRG, run.

sudo journalctl -b | grep lkrg

To keep watching systemd journal log for new LKRG messages, run.

sudo journalctl -b -f | grep lkrg

While performing the commands above, it may be useful to open another console tab and manually run a LKRG integrity check.

sudo sysctl -w lkrg.force_run=1

At this stage a graphical user interface (GUI) is not provided that can proactively inform users who fail to analyze the systemd journal log for relevant LKRG messages. A GUI or popup notification might be developed later on -- help is most welcome.

Debugging[edit]

linux-image[edit]

dpkg -l | grep linux-image

Should include:

ii  linux-image-4.19.0-6-amd64                    4.19.67-2+deb10u2               amd64        Linux 4.19 for 64-bit PCs (signed)
ii  linux-image-amd64

linux-headers[edit]

dpkg -l | grep linux-head

Should include:

ii  linux-headers-4.19.0-6-amd64                  4.19.67-2+deb10u2               amd64        Header files for Linux 4.19.0-6-amd64
ii  linux-headers-4.19.0-6-common                 4.19.67-2+deb10u2               all          Common header files for Linux 4.19.0-6
ii  linux-headers-amd64 

modinfo[edit]

sudo modinfo p_lkrg

filename:       /lib/modules/4.19.0-6-amd64/updates/dkms/p_lkrg.ko
license:        GPL v2
description:    pi3's Linux kernel Runtime Guard
author:         Adam 'pi3' Zabrocki (http://pi3.com.pl)
depends:        usbcore
retpoline:      Y
name:           p_lkrg
vermagic:       4.19.0-6-amd64 SMP mod_unload modversions 
parm:           p_init_log_level:Logging level init value [1 (alive) is default] (uint)

dkms status[edit]

sudo dkms status

Should include:

lkrg, 0.7, 4.19.0-6-amd64, x86_64: installed

Additional Resources[edit]

Forum Discussion[edit]

Upstream Resources[edit]

Upstream Mailing List Discussions[edit]

See Also[edit]

References[edit]

  1. 2.0 2.1 https://www.openwall.com/lkrg/ [archive]
  2. https://openwall.info/wiki/p_lkrg/Main#What-is-LKRG [archive]
  3. https://openwall.info/wiki/p_lkrg/Main#Donation [archive]
  4. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=944476 [archive]
  5. 6.0 6.1 make Linux Kernel Runtime Guard (LKRG) easily available in Qubes [archive]
  6. Only Intel and amd64 are supported at present, see: https://www.openwall.com/lists/lkrg-users/2018/07/31/3 [archive]
  7. Note that LKRG versioning is based on upstream's git master branch intention to remain in the "prerelease" stage. Quote Adam Zabrocki https://www.openwall.com/lists/lkrg-users/2019/11/11/1 [archive] We're trying to keep master branch stable and let's say in "prerelease" stage :)
  8. https://www.openwall.com/lists/lkrg-users/2019/02/19/1 [archive]
  9. Full lock down of the kernel's usermodehelper interface (lkrg.umh_lock). This might break things if your distro uses UMH to invoke any programs. Two options are available:
    • 0 - do NOT lock down the UMH interface fully, but allow to execute only LKRG's whitelisted programs (default)
    • 1 - lock down the UMH interface fully
  10. https://github.com/rapid7/metasploit-framework/blob/master/lib/msf/core/post/linux/kernel.rb#L235 [archive]
    cmd_exec('test -d /proc/sys/lkrg && echo true').to_s.strip.include? 'true'
    
  11. sudo sysctl -w lkrg.hide=1
    lkrg.hide = 1
    
    user@debian-buster-standalone:~$ ls -la /proc/sys/lkrg
    total 0
    dr-xr-xr-x 1 root root 0 Nov 15 03:05 .
    dr-xr-xr-x 1 root root 0 Nov 15 03:04 ..
    -rw------- 1 root root 0 Nov 15 03:48 block_modules
    -rw------- 1 root root 0 Nov 15 03:48 ci_panic
    -rw------- 1 root root 0 Nov 15 04:18 clean_message
    -rw------- 1 root root 0 Nov 15 04:19 force_run
    -rw------- 1 root root 0 Nov 15 04:21 hide
    -rw------- 1 root root 0 Nov 15 03:48 log_level
    -rw------- 1 root root 0 Nov 15 03:48 random_events
    -rw------- 1 root root 0 Nov 15 04:02 smep_panic
    -rw------- 1 root root 0 Nov 15 03:48 timestamp
    -rw------- 1 root root 0 Nov 15 04:04 umh_lock
    
    user@debian-buster-standalone:~$ lsmod | grep lkrg
    usbcore               294912  1 p_lkrg
    
    user@debian-buster-standalone:~$ sudo sysctl -w  lkrg.hide=0
    lkrg.hide = 0
    
    user@debian-buster-standalone:~$ lsmod | grep lkrg
    p_lkrg                217088  -2
    usbcore               294912  1 p_lkrg
    
  12. Hiding (lkrg.hide) - if built with this optional feature included, LKRG can (un)hide itself from the module list (but it can be detected regardless):
    • 1 - hide LKRG (if it is not already hidden)
    • 0 - unhide LKRG (if it is not already unhidden)


Follow: Twitter.png Facebook.png 1280px-Gab text logo.svg.png Rss.png Matrix logo.svg.png 1024px-Telegram 2019 Logo.svg.png Discourse logo.svg

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate whonix.png

Share: Twitter | Facebook

Interested in becoming an author for the Whonix News Blog [archive] or writing about anonymity, privacy and security? Please get in touch!

https link onion link

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation.

Copyright (C) 2012 - 2019 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].

Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint.