Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 21 Jun 2020 14:58:34 +0200
From: Solar Designer <>
Subject: Re: The lkrg.service for systemd

On Sun, Jun 21, 2020 at 11:07:10AM +0200, Mikhail Morfikov wrote:
> On 20/06/2020 23:39, Solar Designer wrote:
> > On Fri, Jun 05, 2020 at 05:36:49PM +0200, Mikhail Morfikov wrote:
> >> You provide the lkrg.service file for systemd. It basically loads/unloads the 
> >> LKRG module and currently has the following boot dependencies:
> >>
> >>
> >>
> > 
> > As I recall, part of the rationale here was to load LKRG before a
> > potential attacker could connect over network.  
> In such case, you should use instead of just
> See here[1] for detailed explanation. 
> [1]:

Thank you!  Looks like our choice of simply is a bug as
it does not fully meet the rationale.

There's yet another issue, though: LKRG may take a little while to
initialize before it's fully monitoring for attacks and enforcing its
configured policies, yet the boot process may concurrently proceed
further and e.g. start crond and an exploit from there.

Do you have suggestions on how to make system boot process wait before
advancing to a phase where user code may run until LKRG is ready?

> Sysctl also has its /etc/sysctl.d/ dir, in which you can place a file like 
> 99-lkrg.conf, and add all the sysctl options (commented out and maybe with 
> some description for easier config). This is also systemd specific option 
> and it has the following deps:
>   After=systemd-modules-load.service

As discussed on this mailing list before you joined, setting LKRG
sysctl's from /etc/sysctl.conf or /etc/sysctl.d didn't work because
these were processed before LKRG is loaded.  With your suggested
alternative below, this should become possible.

> So to sum up, I think the following set of file would be needed:
> /etc/modules-load.d/99-lkrg.conf  # to load the LKRG module
> /etc/modprobe.d/lkrg.conf         # to set module options
> /etc/sysctl.d/99-lkrg.conf        # to change LKRG config via sysctl -p
> As you can see, if you want to support systemd init, you don't have to make
> another service file, just use the three files above, and systemd will take 
> care of dependencies and other stuff needed to load kernel modules.

This sounds right.

What would you suggest we put into the documentation for those wanting
to use other init systems?  Our current draft documentation (not yet
committed) for the upcoming 0.8 release contains this:


If your Linux distribution uses systemd, you can install LKRG with:

        sudo make install

while you're still in its top level source code directory.

Run the following command to start the LKRG service just like it would be
started on next system bootup:

        sudo systemctl start lkrg

You can uninstall LKRG using "make" as well (still in the same directory):

        sudo make uninstall

In fact, you would need to do this before installing a new version of LKRG.

You can also use the following command to temporarily stop the LKRG service
without uninstalling it:

        sudo systemctl stop lkrg

We don't in any way favor systemd over other init systems, and would gladly add
support for those as well if there's demand or especially if we receive such
contributions.  Meanwhile, on a system without systemd you can let "sudo make
install" partially complete (up to the point where it finds you're not using
systemd) and then use:

        sudo modprobe p_lkrg

to load the module.  You can also put the "modprobe p_lkrg" command into a
system startup script.

With the 0.8 release being (hopefully) just around the corner, I think
switching to /etc/modules-load.d/99-lkrg.conf is too invasive a change
right now, but perhaps we can change the Before/After lines for now and
plan on making further changes for 0.9.

> I would suggest something like:
>   After=systemd-modules-load.service  # to make sure all other modules are loaded
>               # to load LKRG as fast a possible

Can you please test this suggestion of yours and confirm that it works?



Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.