LKRG 0.8 Released For Increasing Linux Kernel Runtime Security

Version 0.8 of the Linux Kernel Runtime Guard (LKRG) has been released for further enhancing the runtime security provided by this out-of-tree kernel code plus other general improvements.

The Linux Kernel Runtime Guard provides runtime integrity checking of the kernel and various runtime detection of different security exploits. This out-of-tree kernel module saw a big update on Thursday in the form of v0.8.

LKRG 0.8 brings support for newer versions of the Linux kernel, support for kernels compiled using aggressive GCC compiler optimizations, support for handling ACPI S3/S4 modes, experimental support for 32-bit ARM, experimental support for Raspberry Pi 4, x86_64 Intel SMAP bit validation/enforcement, better scalability of the process tracking database, various new configuration tunables, and other changes.

A few months back I provided some benchmarks of the LKRG overhead. I'll have out some new LKRG 0.8 performance numbers soon. The v0.8 release announcement also notes:

As LKRG developers, we found most of the results reasonable, but were surprised by some. Anyhow, the overall performance impact of LKRG as seen from the geometric mean of all test results was around 4.4%. This was before the many performance-related improvements now included in LKRG 0.8. We contacted Michael, and he kindly instructed us how to rerun the exact same set of 58 tests. Our own results, now included in the PERFORMANCE file, show LKRG 0.8 have an overall performance impact of around 2.5% for the heavy profile (which is the default) and around 2.0% for the light profile, although the individual test results vary.

More details on LKRG 0.8 within the release announcement and Openwall project site.