LKRG Fails to Hook do_seccomp() Due to Compiler Inlining on Kernel 4.19.246

[Ssspade]

When insmod lkrg.ko on Linux kernel version 4.19.246, initialization fails due to inability to hook the do_seccomp()function. The error log indicates:

[   61.723875] LKRG: ALIVE: Loading LKRG
[   61.747867] Freezing user space processes ... (elapsed 0.001 seconds) done.
[   61.755992] OOM killer disabled.
[   61.781892] LKRG: ISSUE: register_k[ret]probe() for do_seccomp failed! [err=-2]
[   61.789190] LKRG: FATAL: Can't hook seccomp
[   61.793360] LKRG: FATAL: Can't initialize exploit detection features
[   61.799702] LKRG: DYING: Not loading LKRG (initialization failed)

I found that the do_seccomp() has been inlined by the compiler in this kernel version, and its symbol is not available in the kernel symbol table, so LKRG's kprobe mechanism cannot resolve the function address.

[solardiz]

Thanks. Is this kernel build from a distro, or your own custom build? You could use our scripts/add-exports.sh.

[Ssspade]

Yes, it's my own custom build, based directly on the upstream kernel source.

[solardiz]

What compiler/version/options did you build the kernel with?