Openwall Project Kernel Module Release (Linux Kernel Runtime Guard) that provides detection of unauthorized modifications to the running kernel (integrity check) or attempts to change the privileges of user processes (exploit detection). The module is suitable for protecting against both known kernel exploits (for example, in situations where it is problematic to update the kernel) and against exploits for yet unknown vulnerabilities. Details about LKRG can be found in .
Among the changes in the new version:
- The code has been refactored to support various CPU architectures. Initial support for the ARM64 architecture has been added;
- Compatibility with Linux kernels 5.1 and 5.2 has been ensured, as well as with kernels compiled without including the CONFIG_DYNAMIC_DEBUG options during kernel compilation,
CONFIG_ACPI and CONFIG_STACKTRACE, and with kernels compiled with the CONFIG_STATIC_USERMODEHELPER option. Experimental support for kernels from the grsecurity project has been added; - The initialization logic has been significantly changed;
- The integrity checking subsystem has reinstated self-hashing and removed a race condition in the jump label engine (*_JUMP_LABEL), which caused deadlocks when initializing simultaneously with loading or unloading events of other modules;
- New sysctl parameters lkrg.smep_panic (enabled by default) and lkrg.umh_lock (disabled by default) have been added to the exploit detection code, along with additional checks for the SMEP/WP bit. The logic for tracking new tasks in the system has been changed, internal synchronization logic with task resources has been revamped, and support for OverlayFS has been added, with Ubuntu Apport being whitelisted.
Source: opennet.ru
