Heki: Hypervisor-Enforced Kernel Integrity for Linux with KVM
summary
Heki moves selected kernel self‑protections out of the kernel into a KVM hypervisor layer, providing a guest API and a KVM backend that uses EPT/MBAC enforcement to tie physical pages to exec/nowrite attributes and a small CR pinning API to prevent toggling control bits. A demo shows an exploit that disables kernel execute protections is blocked by the hypervisor and produces a fetch fault; current limits are static-only mappings, no kernel page‑fault handling for mapped faults, no nested/AMD support yet, and an RFC plus code is available for testing.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:30Leverage virtualization
- 9:26Security policies
- 16:48Memory protection hypercall
- 20:39Kernel memory permissions without MBEC
- 30:38Current limitations
related talks
41mHypervisor-Enforced Kernel Integrity (Heki) for KVM
26mHypervisor Based Integrity: Protect Guest Kernel in Cloud
18mGuest Memory Protection -- Current Status and Future
38mKernel Hardening: Protecting the Protection Mechanisms
50mProtected KVM on Arm64: A Technical Deep Dive
47mLinux Virtualization Based Security
49mBreaking Hardware-Enforced Security With Hypervisors
20mIntel Virtualization Technology Extensions to Enable Hardware Isolated VMs