The Openwall Project has released version 0.9.2 of the LKRG (Linux Kernel Runtime Guard) kernel module, designed to detect and block attacks and integrity violations in kernel structures. For example, the module can protect against unauthorized modifications to a running kernel and attempts to change the privileges of user processes (determining the application of exploits). The module is suitable for providing protection against exploits of known vulnerabilities in the Linux kernel (for instance, in situations where it's difficult to update the kernel in the system) as well as for countering exploits for unknown vulnerabilities. The project code is distributed under the GPLv2 license. Details about the implementation of LKRG can be found in the project's first announcement.
Among the changes in the new version:
- Compatibility is ensured with Linux kernels from 5.14 to 5.16-rc, as well as with LTS kernel updates 5.4.118+, 4.19.191+, and 4.14.233+.
- Support for various CONFIG_SECCOMP configurations has been added.
- Support for the kernel parameter 'nolkrg' has been added to deactivate LKRG at boot time.
- False positives due to a race condition when processing SECCOMP_FILTER_FLAG_TSYNC have been eliminated.
- The possibility of using the CONFIG_HAVE_STATIC_CALL setting in Linux kernels 5.10+ has been established to block race conditions when unloading other modules.
- Module names that were blocked when using the setting lkrg.block_modules=1 are now logged.
- Sysctl settings are now implemented in the file /etc/sysctl.d/01-lkrg.conf.
- A dkms.conf configuration file has been added for the DKMS (Dynamic Kernel Module Support) system, used for building third-party modules after a kernel update.
- Support for debug builds and continuous integration systems has been improved and updated.
Source: opennet.ru
