Linux Kernel Runtime Guard (LKRG) in Qubes OS Debian or Kicksecure for Qubes VMs
HowTo: Install LKRG in Qubes Debian or Kicksecure-Qubes Template
Deprecated for now, see LKRG deprecation in Kicksecure.
Linux Kernel Runtime Guard (LKRG) protects the kernel. It provides security through diversity and has a similar effect to running an uncommon operating system (kernel). [1]
LKRG renders whole classes of kernel exploits ineffective, while making other exploits less reliable and more difficult to write; see features and security. LKRG was developed by a security professional with reviews undertaken by other high profile security professionals; see authorship. For further information, refer to the main LKRG entry.
The instructions below explain how to install LKRG in Qubes Debian-based VMs. Most users will want to apply these instructions in the Qubes Debian Template.
Kicksecure-Qubes is supported as well, but in that case the steps to add the signing key and repository should be skipped because they are already present in Kicksecure-Qubes.
For all other platforms , see LKRG.
Qubes VM Kernel[edit]
Since LKRG is a kernel module, it is required (and advisable) to reconfigure the VM to use a Qubes VM kernel. [2]
Any issues with Qubes VM kernel should not be confused with LKRG. Otherwise, LKRG could be falsely suspected of causing unrelated issues, which wastes time in successfully completing the configuration.
- Follow the Qubes OS Installing kernel in Debian VM instructions.
- Ensure the Qubes VM kernel is functional before proceeding -- Qubes VM kernel issues should be raised at Qubes support and not in Kicksecure forums. [3] [4]
- Reboot dom0 with Qubes VM kernel. This is because Qubes VM kernel might break unrelated things such as the USB VM. [5]
- Once the Qubes VM kernel is functional, proceed with the following instructions.
Add Repository[edit]
There are two different options to enable the Kicksecure APT repository. Choose one. [6]
Using extrepo
1. Install package extrepo
.
sudo apt install extrepo
2. Enable the stable kicksecure
APT repository. (See footnote for other options.) [7]
3. Advanced options.
For advanced options such as clearnet over Tor or onion. [8]
Please press on expand on the right side.
Optional.
Install apt-transport-tor
.
Install package(s) apt-transport-tor
. Follow steps A to E.
Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: In Template.
Update the package lists and upgrade the system .
sudo apt update && sudo apt full-upgrade
Install the apt-transport-tor
package(s).
Using apt
command line
--no-install-recommends
option
is in most cases optional.
sudo apt install --no-install-recommends apt-transport-tor
Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification .
Done.
The procedure of installing package(s) apt-transport-tor
is complete.
Find out filename.
ls -la /etc/apt/sources.list.d/extrepo_*
NOTE: Filename will be different if using a repository other than the stable repository such as the testers repository.
Open file /etc/apt/sources.list.d/extrepo_kicksecure.sources
in an editor with root rights.
Kicksecure
This box uses sudoedit
for better security.
sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources
Kicksecure for Qubes
NOTES:
- When using Kicksecure-Qubes, this needs to be done inside the Template.
sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources
- After applying this change, shutdown the Template.
- All App Qubes based on the Template need to be restarted if they were already running.
- This is a general procedure required for Qubes and unspecific to Kicksecure for Qubes.
Others and Alternatives
- This is just an example. Other tools could achieve the same goal.
- If this example does not work for you or if you are not using Kicksecure, please refer to this link.
sudoedit /etc/apt/sources.list.d/extrepo_kicksecure.sources
Choose either option A) or B).
- A) Clearnet over Tor Repository: To enable clearnet over Tor,
tor+
needs do be prepended in front of thehttps
. The same in other words, look for Uris: https and replace it with Uris: tor+https . - B) Onion Repository: To enable onion, look for the line starting with
Uris:
. Delete the whole line. Or out-comment it by adding as hash ("#
") in front of it. Then add a new line: Uris: tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion
4. Done.
The Kicksecure APT repository has been enabled [9]
Manually
Add Signing Key
Complete the following steps to add the Kicksecure Signing Key to the system's APT keyring.
Open a terminal.
1. Package curl
needs to be installed.
Install package(s) curl
. Follow steps A to E.
Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: In Template.
Update the package lists and upgrade the system .
sudo apt update && sudo apt full-upgrade
Install the curl
package(s).
Using apt
command line
--no-install-recommends
option
is in most cases optional.
sudo apt install --no-install-recommends curl
Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification .
Done.
The procedure of installing package(s) curl
is complete.
2. Download Kicksecure Signing Key. [10]
Choose your operating system.
A : Debian
If you are using Debian, run.
Choose TLS or onion.
sudo curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.kicksecure.com/keys/derivative.asc
B : Qubes
If you are using a Qubes Debian Template, run.
Choose TLS or onion.
sudo http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 curl --tlsv1.3 --output /usr/share/keyrings/derivative.asc --url https://www.kicksecure.com/keys/derivative.asc
3. Users can check Kicksecure Signing Key for better security.
4. Done.
The procedure of adding the Kicksecure signing key is now complete.
Add Repository
Add the Kicksecure APT Repository.
Choose either: Option A, Option B OR Option C
A : Onion Rep.
Option A: Add Kicksecure Onion Repository.
To add Kicksecure Repository over Onion please install apt-transport-tor
from the Debian repository.
sudo apt install apt-transport-tor
Add Kicksecure APT repository for default Kicksecure using Debian stable. At the time of writing this was bookworm
.
echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+http://deb.w5j6stm77zs6652pgsij4awcjeel3eco7kvipheu6mtr623eyyehj4yd.onion bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list
B : Clearnet Rep. via Tor
Option B: Add Kicksecure Clearnet Repository over Tor.
To add Kicksecure Repository over torified clearnet install apt-transport-tor
from the Debian repository.
sudo apt install apt-transport-tor
Add Kicksecure APT repository for default Kicksecure using Debian stable. At the time of writing this was bookworm
.
echo "deb [signed-by=/usr/share/keyrings/derivative.asc] tor+https://deb.kicksecure.com bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list
C : Clearnet Rep.
Option C: Add Kicksecure Clearnet Repository over clearnet.
NOTE: When later using Kicksecure repository tool, then this will be upgraded to "Clearnet Rep. via Tor", unless see footnote. [11]
To add Kicksecure Repository over clearnet please add Kicksecure APT repository for default Kicksecure using Debian stable. At the time of writing this was bookworm
.
echo "deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bookworm main contrib non-free" | sudo tee /etc/apt/sources.list.d/derivative.list
The procedure of adding the Kicksecure repository is now complete.
Install LKRG[edit]
Install LKRG.
Install package(s) lkrg-dkms linux-headers-amd64
. Follow steps A to E.
Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: In Template.
Update the package lists and upgrade the system .
sudo apt update && sudo apt full-upgrade
Install the lkrg-dkms linux-headers-amd64
package(s).
Using apt
command line
--no-install-recommends
option
is in most cases optional.
sudo apt install --no-install-recommends lkrg-dkms linux-headers-amd64
Platform specific notice.
- Kicksecure: No special notice.
- Kicksecure-Qubes: Shut down Template and restart App Qubes based on it as per Qubes Template Modification .
Done.
The procedure of installing package(s) lkrg-dkms linux-headers-amd64
is complete.
The LKRG installation procedure is complete. Interested users can learn more, consider additional hardening and so on; see here for further information.
Credits and Source Code[edit]
The original source software is maintained by Adam "pi3" Zabrocki. See also: LKRG authorship.
This website with Qubes instructions and LKRG Debian Package Website is the software fork homepage for LKRG, with a focus on easy installation, added user documentation, and integration with Kicksecure, Debian, Whonix and other distributions. The software fork source code can be found here.
References[edit]
Qubes ticket: make Linux Kernel Runtime Guard (LKRG) easily avaialble in Qubes
- ↑ https://lkrg.org/
- ↑ cannot compile LKRG (Linux Kernel Runtime Guard) with Qubes dom0 kernel / broken gcc plugins structleak_plugin.so latent_entropy_plugin.so This probably occurs due to this recently closed issue which has only filtered through to Qubes OS master branches, but not the stable branches: kernel-devel package have broken gcc plugin. The dom0 kernel compilation bug might be fixed after upgrades. It is unclear if it would then be advisable to use dom0 kernel.
- ↑ https://forums.whonix.org/t/what-to-post-in-this-qubes-whonix-forum-and-what-not/2275
- ↑ Qubes feature request: Simplify and promote using in-vm kernel
- ↑ As experienced firsthand by Kicksecure developer Patrick Schleizer.
- ↑
extrepo
vs manual:- Usability:
- There are some detail usability differences. Using onion connection might be easier with manual method until Kicksecure gets ported to Debian
13
/trixie
becauseextrepo
might get onion support then. - Apart from that,
extrepo
's usability seems generally better.
- There are some detail usability differences. Using onion connection might be easier with manual method until Kicksecure gets ported to Debian
- Security:
- A detailed comparative research of both methods is unavailable.
- If usability is considered a security feature, then
extrepo
might be considered more secure. This is because users do not have to learn as much about Verifying Software Signatures, OpenPGP, its many Software Signature Verification Usability Issues. Debian which is already trusted by the user providing a trust path to the Kicksecure signing key. Manual key fingerprint verification not required. - The
extrepo
project is a huge amount of work adding all the signing keys for many different projects. The code for securely downloading a signing key in the Python is not among the most difficult programming tasks to get correct. Compared withcurl
(written in C), it might be more secure.
- Keeping support for manual method:
- Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case
extrepo
signing key is outdated, get deprecated, it's easy to switch back to manual method.
- Removal of the manual method is not planned. Since already written, the maintenance effort for that very part of documentation is low. In case
- Usability:
- ↑
stable-proposed-updates
repository: sudo extrepo enable kicksecure_proposedtesters
repository: sudo extrepo enable kicksecure_testersdevelopers
repository: sudo extrepo enable kicksecure_developers - ↑ extrepo feature request: extrepo apt-transport-tor and onion support
- ↑ forum discussion: extrepo - safely adding repos
- ↑
See Secure Downloads to understand why
curl
and the parameters--tlsv1.3
are used instead ofwget
.
Placing an additional signing key into folder/usr/share/keyrings
by itself alone has no impact on security as this folder is not automatically used by Debian's APT by default. Only when an APT sources list configuration file points to folder/usr/share/keyrings
using thesigned-by
keyword the signing key will be actually used. Therefore deleting keys in/usr/share/keyrings
is optional if intending to disable an APT repository. See also APT Signing Key Folders. - ↑
Unless using
repository-dist --transport plain-tls
. See alsoman repository-dist
.
We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!