Last Updated on January 10, 2022
Linux Kernel Runtime Guard (LKRG) is a loadable kernel module that performs runtime integrity checking of the Linux kernel and detection of security vulnerability exploits against the kernel. As controversial as this concept is, LKRG attempts to post-detect and hopefully promptly respond to unauthorized modifications to the running Linux kernel (integrity checking) or to credentials (such as user IDs) of the running processes (exploit detection).
For process credentials, LKRG attempts to detect the exploit and take action before the kernel would grant the process access (such as open a file) based on the unauthorized credentials.
Being a kernel module (not a kernel patch), LKRG can be built for and loaded on top of a wide range of mainline and distros’ kernels, without needing to patch those.
LKRG is currently in an early experimental stage.