{"id":99848,"date":"2021-04-15T22:22:47","date_gmt":"2021-04-15T20:22:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-modulya-lkrg-0-9-0-dlya-zashhity-ot-ekspluataczii-uyazvimostej-v-yadre-linux"},"modified":"2021-04-15T22:22:47","modified_gmt":"2021-04-15T20:22:47","slug":"vypusk-modulya-lkrg-0-9-0-dlya-zashhity-ot-ekspluataczii-uyazvimostej-v-yadre-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-modulya-lkrg-0-9-0-dlya-zashhity-ot-ekspluataczii-uyazvimostej-v-yadre-linux","title":{"rendered":"Release of module LKRG 0.9.0 for protection against exploitation of vulnerabilities in the Linux kernel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The Openwall project has released version 0.9.0 of the LKRG (Linux Kernel Runtime Guard) kernel module, designed to detect and block kernel attacks and integrity violations. For instance, the module can protect against unauthorized modifications to a running kernel and attempts to change the privileges of user processes (identifying exploit usage). The module is suitable for protecting against exploits of known vulnerabilities in the Linux kernel (for example, in situations where updating the kernel is problematic), as well as for combating exploits for yet undiscovered vulnerabilities. The project code is distributed under the GPLv2 license. <\/p>\n
Among the changes in the new version: <\/p>\n
\n
Compatibility is ensured with Linux kernels from 5.8 to 5.12, as well as with stable kernels 5.4.87 and newer (including innovations from kernels 5.8 and newer) and with kernels from RHEL versions up to 8.4, while retaining support for all previously supported kernel versions, such as those from RHEL 7.\n
The ability to build LKRG not only as an external module but also as part of the Linux kernel tree has been added, including its inclusion in the kernel image.\n
Support for many additional kernel and system configurations has been added.\n
Several significant bugs and shortcomings in LKRG have been fixed.\n
The implementation of some LKRG components has been significantly streamlined.\n
Changes have been made to simplify future support and debugging of LKRG.\n
For testing LKRG, integration with out-of-tree and mkosi has been added.\n
The project repository has been moved from BitBucket to GitHub, and continuous integration has been added using GitHub Actions and mkosi, including build and upload verification of LKRG into kernel releases of Ubuntu, as well as into daily builds of the latest mainline kernels provided by the Ubuntu project. <\/ul>\n
In this version of LKRG, several developers who had not previously participated in the project contributed directly (through pull requests on GitHub). In particular, Boris Lukashev added the ability to build as part of the Linux kernel tree, and Vitaly Chikunov from ALT Linux implemented integration with mkosi and GitHub Actions. <\/p>\n
Overall, despite significant additions, the number of lines of code in LKRG has slightly decreased for the second consecutive time (it also decreased between versions 0.8 and 0.8.1). <\/p>\n
Currently, the package with LKRG in Arch Linux has been updated to version 0.9.0, and several other packages are using recent git versions of LKRG and will likely also be updated to version 0.9.0 and beyond soon. <\/p>\n
Additionally, it is worth noting the recent publication from the developers of the Aurora OS (the Russian modification of Sailfish OS) regarding the potential enhancement of LKRG with ARM TrustZone. <\/p>\n