dhhdjbd This is generally correct regarding to LKRG. From the very beginning, Adam Zabrocki (Adam-pi3 + solardiz) claimed that Linux needs an additional simple layer (hypervisor, ARM TrustZone), which the kernel would not have access to, and that LKRG should work in this layer. If it works in the same memory space as the kernel itself, then can be bypassed by an attacker. But even then, the attacker's exploit will have to race with LKRG to disable this mechanism before LKRG kills the process. See, now we had an exploit that bypassed MTE and disabled the SELinux module. If LKRG worked in such a kernel, then such an exploit had to be even more complicated and therefore harder to write. Otherwise, LKRG would kill such a process.