The Openwall project has released version 0.9.4 of the LKRG (Linux Kernel Runtime Guard) kernel module, designed to detect and block attacks and integrity violations in kernel structures. For example, the module can protect against unauthorized modifications to a running kernel and attempts to change the privileges of user processes (determining the use of exploits). The module is suitable both for providing protection against exploits of already known vulnerabilities in the Linux kernel (for instance, in situations where it is problematic to update the kernel in the system) and for countering exploits for still unknown vulnerabilities. The project's code is distributed under the GPLv2 license. You can read about the features of the LKRG implementation in the project's first announcement.
Among the changes in the new version:
- Support for the OpenRC initialization system has been added.
- Compatibility with LTS Linux kernels 5.15.40+ has been ensured.
- The format of the log messages has been revised for easier automated analysis and improved readability during manual review.
- LKRG utilizes its own log categories, making it easier to separate its messages from the other kernel messages.
- The kernel module has been renamed from p_lkrg to lkrg.
- Installation instructions using DKMS have been added.
Source: opennet.ru
