{{Header}} __NOINDEX__ {{title|title= Linux Kernel Runtime Guard (LKRG) for Debian, Whonix, Qubes, Kicksecure }} {{#seo: |title=Linux Kernel Runtime Guard (LKRG) for Debian, Whonix, Qubes, Kicksecure |description=LKRG performs runtime integrity checking of the Linux kernel and detection of security vulnerability exploits against the kernel. |image=P_lkrg2.png }} [[File:P_lkrg2.png|thumb|LKRG logo]] {{intro| LKRG performs runtime integrity checking of the Linux kernel and detection of security vulnerability exploits against the kernel. }} {{archived}} = Deprecation in Kicksecure = Reasons: * '''Maintenance effort:''' [https://github.com/lkrg-org/lkrg/issues/67 upstream not signing releases, which requires verification of a signed tarballs, which increases maintenance workload] * '''Not stable enough:''' Through testing and integration development in Kicksecure it has been determined that it will never be stable enough to be suitable for installation by default for all users. * '''Security issues?''' '''No.''' Users can keep using LKRG until the next major release (Kicksecure version 18) but it will be [[unsupported]]. * '''Future:''' Is there any chance this package will get unarchived, maintained again in Kicksecure? Yes. ETA (estimated time of arrival): None. No need to ask about it. Should that change, this wiki page will be updated and this wiki chapter deleted. When this might happen? At a later stage of Kicksecure development (when more essential issues such as [[ISO]] availability have been sorted out and when more development resources, contributors are available. * '''Forum discussion:''' https://forums.whonix.org/t/linux-kernel-runtime-guard-lkrg-linux-kernel-runtime-integrity-checking-and-exploit-detection/8477/67 = Introduction = LKRG is Freedom Software / Open Source. * [https://github.com/lkrg-org/lkrg Original LKRG Source Code git Repository] * [https://github.com/{{project_name_short}}/lkrg LKRG Debian Package Lightweight Fork] The focus of this wiki page is to provide simplified user documentation and easy installation of LKRG in Debian, [[Kicksecure]], [[Qubes]], [[Whonix]], and perhaps Debian-based Linux distributions. Installable from an APT repository. This is a lightweight [https://en.wikipedia.org/wiki/Fork_(software_development) software fork] and no changes will be made to the core of LKRG. Links to the [https://lkrg.org/ official LKRG homepage] and other original resources can be found [[#Upstream Resources|here]]. = Download = [[File:P_lkrg2.png|LKRG logo|100px|link= https://lkrg.org/ ]] [[File:Debian.png|30px|link=#debian]] [[File:Kicksecure-basic-logo.png|30px|link=#non-qubes-whonix]] [[File:qubes-logo-blue.png|30px|link=#qubes]] [[File:Tux.png|30px|link=#linux]] '''{{free}}''' [[File:210px-Download_Button.svg.png|210px|link=#Installation|alt=Download LKRG]] = LKRG Overview = This is only a very brief introduction, since LKRG technical details are not the focus of this page. [https://lkrg.org/ Quote official LKRG homepage]:
LKRG performs runtime integrity checking of the Linux kernel and detection of security vulnerability exploits against the kernel.
As controversial as this concept is, LKRG attempts to post-detect and hopefully promptly respond to unauthorized modifications to the running Linux kernel (integrity checking) or to credentials such as user IDs of the running processes (exploit detection). For process credentials, LKRG attempts to detect the exploit and take action before the kernel would grant access (such as open a file) based on the unauthorized credentials.
LKRG defeats many pre-existing exploits of Linux kernel vulnerabilities, and will likely defeat many future exploits (including of yet unknown vulnerabilities) that do not specifically attempt to bypass LKRG. While LKRG is bypassable by design, such bypasses tend to require more complicated and/or less reliable exploits.
To learn more about LKRG, interested readers can: * review the [https://lkrg.org/ official LKRG homepage] * watch the [https://www.youtube.com/watch?v=tOiPM692DOM LKRG Presentation Video] or [https://www.openwall.com/presentations/CONFidence2018-LKRG-Under-The-Hood/ LKRG Presentation Slides] * read the [https://openwall.info/wiki/p_lkrg/Main LKRG Wiki] * [https://www.openwall.com/lists/lkrg-users/2020/06/14/5 LKRG rootkit detection] * consult other [[#Upstream Resources|Upstream Resources]] * LKRG is also mentioned in Master's Thesis [http://jultika.oulu.fi/files/nbnfioulu-202004201485.pdf Effectiveness of Linux Rootkit Detection Tools] == Performance Impact == Quote LKRG upstream:
No benchmarks have yet been performed, but it appears the performance penalty is around 2.5% for fully enabled LKRG.
Quote [https://www.phoronix.com Phoronix.com], [https://www.phoronix.com/review/linux-lkrg-performance Benchmarking The Performance Overhead To The Linux Kernel Runtime Guard] ([https://www.phoronix.com/review/linux-lkrg-performance/5 page 5]), [https://web.archive.org/web/20220305113214/https://www.michaellarabel.com/ Michael Larabel] (code added):
Out of 90 benchmarks run comparing the performance hit on this Intel Core i9 9900KS from LKRG, having LKRG enabled led to around a 5% hit based on the geometric mean of all tests carried out. Granted, some real-world workloads like code compilation speed were impacted much more dramatically while test cases not involving I/O or other kernel operations tended to see no measurable difference in run-time performance.
== LKRG Free vs LKRG Pro == {{project_name_long}} developer Patrick Schleizer [https://forums.whonix.org/t/linux-kernel-runtime-guard-lkrg-linux-kernel-runtime-integrity-checking-and-exploit-detection/8477/3 said]:
Contacted upstream LKRG developers privately. To paraphrase: "We don’t oppose you packaging it. As long as LKRG exists, there will always be a free and libre version. There is no pro version yet. A hypothetical future pro version would not change that." In my words: "there won’t be a grsecurity alike situation where everything gets closed down".
Quote [https://openwall.info/wiki/p_lkrg/Main LKRG wiki]:
We will likely use GPLv2 at least for LKRG free. We might or might not use a different license for LKRG Pro, if we ever make it.
Users who benefit from LKRG Free are encouraged to support its further development. However, at the time of writing they are not accepting donations: https://openwall.info/wiki/p_lkrg/Main#Donation
We used to accept donations for LKRG via Patreon, but we currently don't. Some of our former supporters are listed in the PATREON file in LKRG distribution tarballs.
= Installation = {{testers-only}} Note: Users who require better security can [[Linux_Kernel_Runtime_Guard_LKRG/Build_Debian_Package_from_Source_Code|Build the Linux Kernel Runtime Guard (LKRG) Debian Package from Source Code]] and verify software signatures before installation. {| class="wikitable" |- ! '''Logo''' ! '''Host Operating System''' ! '''Installation Instructions''' ! '''Note''' |- | [[File:Debian.png|50px]] | Debian hosts | Follow the instructions below to install from the {{project_name_short}} repository. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=944476 | If intending to run the VirtualBox [[File:Virtualbox_logo.png|25px|link=]] host software (such as for running {{project_name_short}} [[File:Kicksecure-basic-logo.png|25px|link=]] virtual machine (VM)) [[#Configuration|additional configuration is required]]. LKRG can be installed inside VirtualBox guest VM without configuration changes required. |- | {{Anchor|non-qubes-whonix}}[[File:Kicksecure-basic-logo.png|50px]] | [[Qubes|{{non_q_project_name_short}}]] | Follow the installation instructions below. | In {{project_name_short}}, skip the following "Add {{project_name_short}} repository" step since it is already enabled by default. |- | {{Anchor|qubes}}[[File:qubes-logo-blue.png|50px]] | [https://www.qubes-os.org Qubes OS] Debian based VMs | Follow [[Linux_Kernel_Runtime_Guard_LKRG/Qubes|these LKRG Qubes instructions]]. | See footnote. [https://github.com/QubesOS/qubes-issues/issues/5461 make Linux Kernel Runtime Guard (LKRG) easily available in Qubes] |- | {{Anchor|qubes-debian}}[[File:qubes-logo-blue.png|50px]] [[File:Kicksecure-basic-logo.png|50px]] | [[{{q_project_name_short}}|{{q_project_name_long}}]] | Follow [[Linux_Kernel_Runtime_Guard_LKRG/Qubes|these LKRG {{q_project_name_short}} instructions]]. | See footnote. |- | {{Anchor|linux}}[[File:Tux.png|50px]] | Other Linux distributions | LKRG is available for most Linux distributions. | Follow the installation instructions for non-Debian distributions on the [https://lkrg.org/ official LKRG homepage]. |} Add {{project_name_short}} repository. {{Box|text= {{Project-APT-Repository-Add Easy}} }} Install LKRG. {{Box|text= '''1.''' Update the package lists. {{CodeSelect|code= sudo apt update }} '''2.''' Install LKRG. Only Intel and amd64 are supported at present, see: https://www.openwall.com/lists/lkrg-users/2018/07/31/3 No need for package lkrg-systemd. See [https://github.com/openwall/lkrg/issues/108#issuecomment-886230431 upstream discussion]. Package lkrg is just a meta package. The only thing it would do is adding Depends: lkrg-dkms and Recommends: lkrg-systemd. See also: {{CodeSelect|code= apt-cache show lkrg }} {{CodeSelect|code= apt-cache show lkrg-dkms }} {{CodeSelect|code= apt-cache show lkrg-systemd }} {{CodeSelect|code= sudo apt install lkrg-dkms linux-headers-amd64 }} }} The LKRG installation is complete. Note that LKRG versioning is based on upstream's git master branch intention to remain in the "prerelease" stage. [https://www.openwall.com/lists/lkrg-users/2019/11/11/1 Quote Adam Zabrocki]:
We're trying to keep master branch stable and let's say in "prerelease" stage :)
It is recommended to review optional hardening and other entries below, but this is not required. = Configuration = It might be possible to further improve the security provided by LKRG though LKRG configuration, but this can potentially lead to decreased system stability. Note: [[Unspecific|Unspecific to {{project_name_short}}]]. {{mbox | image = [[File:Ambox_warning_pn.svg.png|40px]] | text = '''Warning:''' These configuration sysctl where up to date at time of writing but might be outdated in future LKRG releases. Please refer to [https://github.com/lkrg-org/lkrg/blob/main/README upstream sysctl configuration documentation] chapter Runtime configuration and [https://github.com/lkrg-org/lkrg/blob/main/scripts/bootup/lkrg.conf upstream configuration file /etc/sysctl.d/30-lkrg-dkms.conf]. }} == General LKRG Configuration Tips == Note: All the possible configuration changes in this section are optional. '''Table:''' ''General LKRG Configuration Tips'' {| class="wikitable" |- ! scope="col"| '''Category''' ! scope="col"| '''Instructions''' |- ! scope="row"| View Current Runtime Configuration | To view the current configuration, run. {{CodeSelect|code= sudo sysctl -a {{!}} grep lkrg }} Refer to [https://github.com/lkrg-org/lkrg/blob/main/README upstream readme] chapter Runtime configuration. |- ! scope="row"| Temporary Runtime Configuration Changes | To temporarily change configuration settings until next reboot, run. Note: Replace lkrg.pcfi_validate=1 with the actual sysctl setting you like to change as per upstream documentation. {{CodeSelect|code= sudo sysctl -w lkrg.pcfi_validate=1 }} |- ! scope="row"| Persistent Configuration Changes | To enable any (LKRG) sysctl persistently after reboot. {{Open_with_root_rights|filename= /etc/sysctl.d/50_user.conf }} Paste (LKRG) sysctl settings such as. Note: Replace lkrg.pcfi_validate=1 with the actual sysctl setting you like to change as per upstream documentation. {{CodeSelect|code= lkrg.pcfi_validate=1 }} Save. The procedure of persistently changing sysctl settings is complete. |- {{Anchor|VirtualBox}} ! scope="row"| VirtualBox host software compatibility | {{CodeSelect|code= lkrg.pcfi_validate=1 }} Not required for VirtualBox guest VM. [https://github.com/lkrg-org/lkrg/issues/82#issuecomment-886188999 VirtualBox host software compatibility] |- |} == {{project_name_short}} specific LKRG Configuration Tips == '''Table:''' ''{{project_name_short}} specific LKRG Configuration Tips'' {| class="wikitable" |- ! scope="col"| '''Category''' ! scope="col"| '''Instructions''' |- ! scope="row"| Block Module Loading | Users which use lkrg.block_modules in {{project_name_short}} would also have to follow {{project_name_short}} instructions on [[Operating_System_Hardening#Module_Loading|module loading]]. |- ! scope="row"| Hardening - UMH Validation and Enforcement | Better do not use lkrg.umh_validate=2 for now. Might break [[{{project_name_gateway_short}}_Firewall|{{project_name_short}} Firewall]]. Advanced users could refer to upstream documentation on lkrg.umh_validate and lkrg.umh_enforce. |- |} = Usage = Once LKRG has been installed, little effort is required since it will protect the kernel without the user's knowledge and/or interaction. However, it is sensible to check that LKRG is running correctly and to monitor system logs for any suspicious entries. Check this entry at a later date for any additional recommendations. To check systemd journal log for kernel messages by LKRG, run. {{CodeSelect|code= sudo journalctl -b {{!}} grep lkrg }} To keep watching systemd journal log for new LKRG messages, run. {{CodeSelect|code= sudo journalctl -b -f {{!}} grep lkrg }} At this stage a graphical user interface (GUI) is not provided that can proactively inform users who fail to analyze the systemd journal log for relevant LKRG messages. A GUI or popup notification might be developed later on -- [[Contribute|help is most welcome]]. = Recovery = Quote upstream readme:
To account for the hopefully unlikely but really unfortunate event that some incompatibility between the Linux kernel or other components of the system and LKRG isn't detected prior to LKRG installation yet leads to system crash on bootup, we've included support for the "nolkrg" kernel parameter in the systemd unit file for LKRG. Thus, if you've followed the above installation procedure for LKRG with systemd, you may disable LKRG by specifying "nolkrg" on the kernel command-line via your bootloader. The system should then boot up without LKRG, and thus without triggering the problem, letting you fix it.
[https://github.com/lkrg-org/lkrg/issues/108#issuecomment-886236610 Quote upstream contributor]:
[...] I would use a different kernel cmd parameter: `systemd.unit=emergency.target` -- which drops me to the shell before even mounting (as read/write) the root file system, and I can disable whatever service I want. [...]
= Secure Boot = Not compatible because it is a kernel module. = Kicksecure Feature Default Status Information = Not installed by default. * Risk of broken VM boot after LKRG major version upgrade. * Risk of broken VM if using kernel from backports or porting to the next major version of Debian. * Broken in Qubes? = Debugging = == linux-image == {{CodeSelect|code= dpkg -l {{!}} grep linux-image }} Should include:
ii  linux-image-4.19.0-6-amd64                    4.19.67-2+deb10u2               amd64        Linux 4.19 for 64-bit PCs (signed)
ii  linux-image-amd64
== linux-headers == {{CodeSelect|code= dpkg -l {{!}} grep linux-head }} Should include:
ii  linux-headers-4.19.0-6-amd64                  4.19.67-2+deb10u2               amd64        Header files for Linux 4.19.0-6-amd64
ii  linux-headers-4.19.0-6-common                 4.19.67-2+deb10u2               all          Common header files for Linux 4.19.0-6
ii  linux-headers-amd64
== modinfo == {{CodeSelect|code= sudo modinfo p_lkrg }}
filename:       /lib/modules/5.10.0-0.bpo.7-amd64/updates/dkms/p_lkrg.ko
license:        GPL v2
description:    pi3's Linux kernel Runtime Guard
author:         Adam 'pi3' Zabrocki (http://pi3.com.pl)
depends:
retpoline:      Y
name:           p_lkrg
vermagic:       5.10.0-0.bpo.7-amd64 SMP mod_unload modversions
parm:           log_level:log_level [3 (warn) is default] (uint)
parm:           heartbeat:heartbeat [0 (don't print) is default] (uint)
parm:           block_modules:block_modules [0 (don't block) is default] (uint)
parm:           interval:interval [15 seconds is default] (uint)
parm:           kint_validate:kint_validate [3 (periodically + random events) is default] (uint)
parm:           kint_enforce:kint_enforce [2 (panic) is default] (uint)
parm:           msr_validate:msr_validate [0 (disabled) is default] (uint)
parm:           pint_validate:pint_validate [1 (current) is default] (uint)
parm:           pint_enforce:pint_enforce [1 (kill task) is default] (uint)
parm:           umh_validate:umh_validate [1 (allow specific paths) is default] (uint)
parm:           umh_enforce:umh_enforce [1 (prevent execution) is default] (uint)
parm:           pcfi_validate:pcfi_validate [2 (fully enabled pCFI) is default] (uint)
parm:           pcfi_enforce:pcfi_enforce [1 (kill task) is default] (uint)
parm:           smep_validate:smep_validate [1 (enabled) is default] (uint)
parm:           smep_enforce:smep_enforce [2 (panic) is default] (uint)
parm:           smap_validate:smap_validate [1 (enabled) is default] (uint)
parm:           smap_enforce:smap_enforce [2 (panic) is default] (uint)
== dkms status == {{CodeSelect|code= sudo dkms status }} Should include:
lkrg, 0.7, 4.19.0-6-amd64, x86_64: installed
== Related Files == * [https://github.com/lkrg-org/lkrg/blob/main/debian/lkrg-dkms.modprobe /etc/modprobe.d/lkrg-dkms.conf] * [https://github.com/lkrg-org/lkrg/blob/main/debian/lkrg-dkms.modules /etc/modules-load.d/lkrg-dkms.conf] * [https://github.com/lkrg-org/lkrg/blob/main/scripts/bootup/lkrg.conf /etc/sysctl.d/30-lkrg-dkms.conf] = Additional Resources = == Forum Discussion == * [https://forums.whonix.org/t/linux-kernel-runtime-guard-lkrg-linux-kernel-runtime-integrity-checking-and-exploit-detection/8477/1 Linux Kernel Runtime Guard (LKRG) - Linux Kernel Runtime Integrity Checking and Exploit Detection] == Upstream Resources == * [https://lkrg.org/ LKRG Website] * [https://github.com/lkrg-org/lkrg LKRG Source Code git Repository] * [https://www.youtube.com/watch?v=tOiPM692DOM LKRG Presentation Video] * [https://www.openwall.com/presentations/CONFidence2018-LKRG-Under-The-Hood/ Old LKRG Presentation Slides CONFidence 2018] * [https://www.openwall.com/presentations/OSTconf2020-LKRG-In-A-Nutshell/ Updated LKRG Presentation Slides OSTconf 2020] * [https://www.openwall.com/lists/lkrg-users/ LKRG Mailing List] * [https://openwall.info/wiki/p_lkrg/Main LKRG Wiki] * https://www.openwall.com/lists/lkrg-users/2020/02/28/1 == Upstream Mailing List Discussions == * [https://www.openwall.com/lists/lkrg-users/2019/11/18/3 LKRG compilation hardening flags, checksec, hardening-check] * [https://www.openwall.com/lists/lkrg-users/2019/11/13/5 LKRG packagers / downstream wishlist] (signed git commits, signed git tags, version numbers, logo) * [https://www.openwall.com/lists/lkrg-users/2019/11/10/2 module loading / systemd bug report / suggestion] * [https://www.openwall.com/lists/lkrg-users/2019/11/18/1 LKRG kills VirtualBox host VMs] * [https://github.com/lkrg-org/lkrg/issues/82 VirtualBox host software compatibility] * [https://www.openwall.com/lists/lkrg-users/2019/11/18/2 announcement of this LKRG Debian package on upstream LKRG mailing list] * [https://www.openwall.com/lists/lkrg-users/2020/01/25/2 LKRG module parameters] * [https://www.openwall.com/lists/lkrg-users/2020/02/01/2 Compiling LKRG static into the Kernel / Loading LKRG kernel module as early as possible or after other modules?] == See Also == * [https://github.com/{{project_name_short}}/security-misc security-misc]: Inspired by the Kernel Self Protection Project ([https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project KSPP]). This package implements most if not all recommended Linux kernel settings (sysctl) and kernel parameters set by the KSPP. * [[grub-live|grub-live]]: Boot your existing, installed Debian Host into Live Mode. * [[Hardened-kernel|Hardened VM Kernel]] (in development): A hardened kernel configuration optimized for virtual machines, see: [https://forums.whonix.org/t/kernel-recompilation-for-better-hardening/7598 development discussion]. * [[System Hardening Checklist]] = References = {{reflist|close=1}} {{Footer}} [[Category:Documentation]]