Linux Kernel Runtime Guard (LKRG) in Qubes OS Debian or Kicksecure ™ for Qubes VMs




Linux Kernel Runtime Guard (LKRG) protects the kernel. It provides security through diversity and has a similar effect to running an uncommon operating system (kernel). [1]
LKRG renders whole classes of kernel exploits ineffective, while making other exploits less reliable and more difficult to write; see features and security. LKRG was developed by a security professional with reviews undertaken by other high profile security professionals; see authorship. For further information, refer to the main LKRG entry.
The instructions below explain how to install LKRG in Qubes Debian-based VMs. Most users will want to apply these instructions in the Qubes Debian Template.
Kicksecure ™ for Qubes is supported as well, but in that case the steps to add the signing key and repository should be skipped because they are already present in Kicksecure ™ for Qubes.
For all other platforms , see LKRG.
Qubes VM Kernel[edit]
Since LKRG is a kernel module, it is required (and advisable) to reconfigure the VM to use a Qubes VM kernel. [2]
Any issues with Qubes VM kernel should not be confused with LKRG. Otherwise, LKRG could be falsely suspected of causing unrelated issues, which wastes time in successfully completing the configuration.
- Follow the Qubes OS Installing kernel in Debian VM
instructions.
- Ensure the Qubes VM kernel is functional before proceeding -- Qubes VM kernel issues should be raised at Qubes support
and not in Kicksecure ™ forums. [3] [4]
- Reboot dom0 with Qubes VM kernel. This is because Qubes VM kernel might break unrelated things such as the USB VM. [5]
- Once the Qubes VM kernel is functional, proceed with the following instructions.
Add Signing Key[edit]
Complete the following steps to add the Kicksecure ™ Signing Key to the system's APT keyring.
Open a terminal.
1. Package curl
needs to be installed.
Install curl
. To accomplish that, the following steps A. to D. need to be done.
A. Update the package lists.
B. Upgrade the system.
C. Install the curl
package.
Using apt
command line parameter --no-install-recommends
is in most cases optional.
D. Done.
The procedure of installing curl
is complete.
2. Download Kicksecure ™ Signing Key. [6]
If you are using Debian, run.
If you are using a Qubes Debian Template, run.
3. Users can check Kicksecure ™ Signing Key for better security.
4. Add the Kicksecure ™ signing key to APT's keyring folder. [7]
5. Done.
The procedure of adding Kicksecure ™ signing key is now complete.
Add Repository[edit]
Add Kicksecure ™ Repository.
Choose either: Option A, Option B OR Option C.
Option A: Add Kicksecure ™ Onion Repository.
To add Kicksecure ™ Repository over Onion please press on expand on the right.
Install apt-transport-tor from the Debian repository.
Add Kicksecure ™ APT repository for default Kicksecure ™ using Debian stable. At the time of writing this was bullseye
.
Option B: Add Kicksecure ™ Clearnet Repository over Tor.
To add Kicksecure ™ Repository over torified clearnet please press on expand on the right.
Install apt-transport-tor
from the Debian repository.
Add Kicksecure ™ APT repository for default Kicksecure ™ using Debian stable. At the time of writing this was bullseye
.
Option C: Add Kicksecure Clearnet Repository over clearnet.
To add Kicksecure ™ Repository over clearnet please press on expand on the right.
Add Kicksecure ™ APT repository for default Kicksecure ™ using Debian stable. At the time of writing this was bullseye
.
Install LKRG[edit]
Install LKRG.
Install lkrg-dkms linux-headers-amd64
. To accomplish that, the following steps A. to D. need to be done.
A. Update the package lists.
B. Upgrade the system.
C. Install the lkrg-dkms linux-headers-amd64
package.
Using apt
command line parameter --no-install-recommends
is in most cases optional.
D. Done.
The procedure of installing lkrg-dkms linux-headers-amd64
is complete.
The LKRG installation procedure is complete. Interested users can learn more, consider additional hardening and so on; see here for further information.
Credits and Source Code[edit]
The original source software is maintained by Adam "pi3" Zabrocki. See also: LKRG authorship.
This website with Qubes instructions and LKRG Debian Package Website is the software fork homepage for LKRG, with a focus on easy installation, added user documentation, and integration with Kicksecure, Debian, Whonix and other distributions. The software fork source code can be found here
.
References[edit]
Qubes ticket: make Linux Kernel Runtime Guard (LKRG) easily avaialble in Qubes
- ↑
https://www.openwall.com/lkrg/
- ↑
cannot compile LKRG (Linux Kernel Runtime Guard) with Qubes dom0 kernel / broken gcc plugins structleak_plugin.so latent_entropy_plugin.so
This probably occurs due to this recently closed issue which has only filtered through to Qubes OS master branches, but not the stable branches: kernel-devel package have broken gcc plugin
. The dom0 kernel compilation bug might be fixed after upgrades. It is unclear if it would then be advisable to use dom0 kernel.
- ↑ https://forums.whonix.org/t/what-to-post-in-this-qubes-whonix-forum-and-what-not/2275
- ↑
Qubes feature request: Simplify and promote using in-vm kernel
- ↑ As experienced firsthand by Kicksecure ™ developer Patrick Schleizer.
- ↑
See Secure Downloads to understand why
curl
and the parameters--tlsv1.3 --proto =https
are used instead ofwget
. - ↑
Placing an additional signing key into folder
/usr/share/keyrings
by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder/usr/share/keyrings
using thesigned-by
keyword the signing key will be actually used. Therefore deleting keys in/usr/share/keyrings
is optional if intending to disable an APT repository. See also APT Signing Key Folders.
Unfinished: This wiki is a work in progress. Please do not report broken links until this notice is removed, use Search Engines First and contribute improving this wiki.