Linux Kernel Runtime Guard (LKRG) 1.0
summary
LKRG 1.0 is an out‑of‑tree Linux kernel module that performs runtime integrity checking of kernel image, CPU security flags, and per‑task credentials, and triggers a configurable response (default: kernel panic) when a kernel hash unexpectedly changes. It adds a one‑way Noise‑based encrypted remote logging over TCP, supports CentOS 7 (3.10) through latest 6.x/mainline, four architectures, CI testing, and measures about 2.5% performance overhead; independent testing reports it detects 8/9 rootkits.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 3:43Project origins and evolution
- 10:16Technology landscape and alternatives
- 16:46Runtime integrity checking
- 25:04Blocking kernel interfaces
- 33:23Kernel integration challenges
- 40:11Version 1.0 changes and future
- 43:26Live demonstration
related talks
26mKernel Runtime Security Instrumentation
33mKernel Runtime Security Instrumentation
29mThwarting Unknown Bugs: Hardening Features in the Mainline Linux Kernel
32mLVBS and Advanced Kernel Integrity
26mIt's Coming From Inside the House: Kernelspace Fault Injection with KRF
26mIntegrity
30mProactive Software Defense against Side Channel Attacks
30mLinux Kernel Security Contributions by ANSSI