Linux Kernel Runtime Guard (LKRG) 0.9.5 by Adam 'pi3' Zabrocki et al. is out, adding support for new longterm kernels 5.10.133+ and reworked support for OverlayFS (Docker). openwall.com/lists/announce…

We recommend using a tool called Linux Kernel Runtime Guard (LKRG) which is a kernel module that performs kernel integrity checks to help detect and identify vulnerabilities and exploits.

Linux Kernel Runtime Guard (LKRG) 0.9.6 by Adam 'pi3' Zabrocki et al. is out, adding support for Linux 6.1, RHEL 8.7, current CentOS Stream 9 (upcoming RHEL 9.2), along with a variety of other changes for portability, robustness, and extra security checks. openwall.com/lists/announce…

Linux Kernel Runtime Guard (LKRG) 0.9.7 by Adam 'pi3' Zabrocki et al. is out, adding support for Linux 6.4 to 6.5.x and hopefully beyond, as well as for new RHEL 9.1 and 9.2 kernels. openwall.com/lists/announce…

[5] LKRG for pre and post-incident, here vs reptile rootkit and vs usermodehelper execution

[1] Don't need Linux User Mode Helper? Block it with LKRG! User mode helper (UMH) is a feature in the Linux kernel that allows user-level processes to execute code in kernel mode with the assistance of a privileged helper program. LKRG performs runtime integrity checking of...

LKRG: Rocky Linux announced a Special Interest Group (SIG) focused on Security and, among others, adds Linux Kernel Runtime Guard (LKRG) package: rockylinux.org/pl/news/securi… CC: Solar Designer

Linux Kernel Runtime Guard (LKRG) 0.9.8 by Adam 'pi3' Zabrocki et al. is out, adding a remote kernel message logging capability sponsored by BINARLY🔬. openwall.com/lists/announce… This update is already packaged for Rocky Enterprise Linux 8.9 and 9.3 Rocky Linux. sig-security.rocky.page/packages/lkrg/

Slides of Solar Designer's talk "Linux kernel remote logging: approaches, challenges, implementation" from BSidesZagreb openwall.com/lists/announce… The talk also included live demo of LKRG LKRG catching chompie's CVE-2021-3490 exploit and logging this event on another continent

This particular exploit (but not the vulnerability!) is prevented by LKRG's usermodehelper allow list. Just tested on Rocky Linux 9.3 with SIG/Security package of LKRG - exploit stuck at "[*] overwriting path with PIDs in range 0->4194304..." & the expected LKRG alert flood.

Linux kernel "GSM" exploit vs LKRG 🔥LKRG

Linux Kernel Runtime Guard LKRG 0.9.9 by Adam 'pi3' Zabrocki et al. is out, adds support for Linux 6.11+, 6.10.10+, 5.10.220+, CentOS Stream 9 (upcoming RHEL 9.5). openwall.com/lists/announce… Updated packages for Rocky Linux 9.4 and 8.10 being released sig-security.rocky.page/packages/lkrg/ Rocky Linux

Hardened Rocky Linux from CIQ is shipped with LKRG (LKRG)!

🔒 Enhancing LKRG: A Step Toward Stronger Security. CIQ's own Sultan Alsawaf recently contributed impactful updates to the LKRG project, fixing longstanding bugs & making it stronger & more stable than ever. Learn more here 🔗 hubs.li/Q03jDBsj0 #HPC #IT #LKRG #OpenSource

At #NullconBerlin2025, Solar Designer will walk us through the journey from LKRG’s edgy debut to its 1.0 release – complete with real-world attacks, trade-offs, nasty bugs, & some honest truths about kernel hardening. Know More: nullcon.net/berlin-2025/sp… #LKRG #LinuxSecurity

What happens when attackers reach your Linux kernel? The Linux Kernel Runtime Guard (LKRG) continuously monitors kernel integrity in real-time, detecting exploits as they happen - including zero-days that other security measures miss. Key features: • Runtime integrity

🧑‍🍳🍽️ If your OS were a restaurant, #LKRG would be the invisible food inspector—checking for tampering in real time. Join Solar Designer at #NullconBerlin2025 as he unpacks how LKRG grew from a bold idea to a powerful #Linux kernel #security tool. 👉 nullcon.net/berlin-2025/sp…

Linux Kernel Runtime Guard LKRG 1.0.0 by Adam 'pi3' Zabrocki Solar Designer Sultan Alsawaf et al. is out, adds support for Linux 6.13+ (tested to 6.17-rc4), forward-edge CFI (Intel CET IBT, KCFI), ..., reduces performance overhead, shrinks the codebase by ~2500 lines. openwall.com/lists/announce…

Linux Kernel Runtime Guard 1.0 Released For Security Vulnerability Exploit Detection phoronix.com/news/LKRG-1.0-…

We've just published the slides of Solar Designer's @Nullcon Berlin 2025 talk "Linux Kernel Runtime Guard (LKRG) 1.0" openwall.com/lists/announce… #LKRG #nullconBerlin2025 #nullcon