[<prev] [day] [month] [year] [list]
Message-ID: <20250920194903.GA465@openwall.com>
Date: Sat, 20 Sep 2025 21:49:03 +0200
From: Solar Designer <solar@...nwall.com>
To: announce@...ts.openwall.com, lkrg-users@...ts.openwall.com
Subject: [openwall-announce] "Linux Kernel Runtime Guard (LKRG) 1.0" Nullcon Berlin 2025 talk slides
Hi,
Earlier this month, I gave a talk timed with the release and entitled
"Linux Kernel Runtime Guard (LKRG) 1.0" at Nullcon Berlin, naturally in
Berlin, Germany. Here are the slides:
https://www.openwall.com/presentations/NullconBerlin2025-LKRG/
A video recording of the talk will likely be posted by Nullcon
organizers soon. We'll add a link from the above web page then.
Meanwhile, already published and linked from there is a 12-minute video
interview with me by Aseem Jakhar from Information Security Media Group,
recorded at Nullcon shortly after the talk.
The talk abstract is as follows:
Linux Kernel Runtime Guard (LKRG) is a Linux kernel module that
performs runtime integrity checking of the kernel and detection of
security vulnerability exploits against the kernel, prevention of and
response to successful attacks, and encrypted remote logging. The
project was founded by Adam 'pi3' Zabrocki, who invited Solar Designer
to join and we released version 0.0 publicly in 2018 under Openwall
umbrella (announced as Openwall's most controversial project to date).
We have been extending and maintaining it since (as an independent
project supported at various times by Binarly and CIQ). While we had a
userbase using it in production (and did so ourselves) during all this
time, now we're finally ready to call it mature and release 1.0.
This talk covers what LKRG is, its security and threat models, how it
does what it does, and how it fits in the landscape (from kernel
hardening patches to eBPF, and beyond Linux). Our perspective on
long-term maintenance of a hackish out-of-tree module (where we hook and
call into many functions that the kernel does not export) and supporting
a wide range of kernel versions (still supporting from CentOS 7 "3.10"
to latest 6.x mainline, as well as stable/longterm branches).
Continuous Integration. Many trade-offs involved. Effectiveness so far
(against rootkits and exploits). Bypasses so far and our stance on
them. Nastiest bugs/issues so far and how we see the risks. Adoption
in distros and products. Future work (evolution towards even greater
maturity, improved self-protection, detection and prevention of
userspace attacks). Beyond the slides: live demo of exploit detection
and prevention, along with remote logging.
Also relevant are our earlier presentations on LKRG: "Linux kernel
remote logging: approaches, challenges, implementation" (2024), "Linux
Kernel Runtime Guard (LKRG) in a nutshell" (2020), and "Linux Kernel
Runtime Guard (LKRG) under the hood" (2018). These are also linked from
the above web page.
I'd like to thank CIQ for enabling me to prepare and give this talk, and
everyone at Nullcon Berlin for such a great event, which I now have good
memories of.
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
