Linux Kernel Runtime Guard (LKRG) in Qubes OS Debian or Qubes-Whonix ™ VMs
LKRG renders whole classes of kernel exploits ineffective, while making other exploits less reliable and more difficult to write; see features and security. LKRG was developed by a security professional with reviews undertaken by other high profile security professionals; see authorship. For further information, refer to the main LKRG entry.
For all other platforms , see LKRG.
Qubes VM Kernel
Since LKRG is a kernel module, it is required (and advisable) to reconfigure the VM to use a Qubes VM kernel. 
Any issues with Qubes VM kernel should not be confused with LKRG. Otherwise, LKRG could be falsely suspected of causing unrelated issues, which wastes time in successfully completing the configuration.
- Follow the Qubes OS Installing kernel in Debian VM [archive] instructions.
- Ensure the Qubes VM kernel is functional before proceeding -- Qubes VM kernel issues should be raised at Qubes support [archive] and not in Whonix ™ forums.  
- Reboot dom0 with Qubes VM kernel. This is because Qubes VM kernel might break unrelated things such as the USB VM. 
- Once the Qubes VM kernel is functional, proceed with the following instructions.
Add Signing Key
The LKRG installation procedure is complete. Interested users can learn more, consider additional hardening and so on; see here for further information.
Credits and Source Code
This website with Qubes instructions and LKRG Debian Package Website is the software fork [archive] homepage for LKRG, with a focus on easy installation, added user documentation, and integration with Whonix, Kicksecure, Debian, and other distributions. The software fork source code can be found here [archive].
- https://www.openwall.com/lkrg/ [archive]
- cannot compile LKRG (Linux Kernel Runtime Guard) with Qubes dom0 kernel / broken gcc plugins structleak_plugin.so latent_entropy_plugin.so [archive] This probably occurs due to this recently closed issue which has only filtered through to Qubes OS master branches, but not the stable branches: kernel-devel package have broken gcc plugin [archive]. The dom0 kernel compilation bug might be fixed after upgrades. It is unclear if it would then be advisable to use dom0 kernel.
- https://forums.whonix.org/t/what-to-post-in-this-qubes-whonix-forum-and-what-not/2275 [archive]
- Qubes feature request: Simplify and promote using in-vm kernel [archive]
- As experienced firsthand by Whonix ™ developer Patrick Schleizer.
The following is unreliable due to gpg connectivity bugs [archive].
sudo apt-key --keyring /etc/apt/trusted.gpg.d/whonix.gpg adv --keyserver hkp://ipv4.pool.sks-keyservers.net:80 --recv-keys 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA
gpgis required by
gpg-agentis required due to the following error message.
sudo apt-key --keyring /etc/apt/trusted.gpg.d/whonix.gpg add ~/patrick.asc
gpg: failed to start agent '/usr/bin/gpg-agent': No such file or directory gpg: can't connect to the agent: No such file or directory
See Secure Downloads to understand why
curland the parameters
--tlsv1.2 --proto =httpsare used instead of
This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.
Copyright (C) 2012 - 2021 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)
The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.