CONFidence 2018: Linux Kernel Runtime Guard (LKRG) under the hood (Adam "pi3" Zabrocki) HD

Linux Kernel Runtime Guard (LKRG) is a loadable kernel module that performs runtime integrity checking of the Linux kernel and detection of security vulnerability exploits (including of yet unknown vulnerabilities) against the kernel. As controversial as this concept is, LKRG attempts to post-detect and hopefully promptly respond to unauthorized modifications to the running Linux kernel (integrity checking) or to credentials (such as user IDs) of the running processes (exploit detection). For process credentials, LKRG attempts to detect the exploit and take action before the kernel would grant the process access (such as open a file) based on the unauthorized credentials. CONFidence: https://confidence-conference.org Facebook: https://www.facebook.com/confidence.conference Twitter: https://twitter.com/CONFidence_news