rfxn-defense

Responsive defense layer for Linux. Ships kernel-LPE mitigations as 0days land, closing the window between public CVE disclosure and the vendor patch reaching your hosts (or a fleet reboot becoming available). Signed yum/dnf repo for EL7/EL8/EL9/EL10, 4-hourly auto-update cron, zero reboot required for any mitigation. New bug classes ship with each release. Install once, stay covered.

Today's shipping coverage: 7 LPE classes across two families. Copy Fail page-cache writes (cf1 / CVE-2026-31431, cf2 / Dirty Frag-ESP / CVE-2026-43284, DF-RxRPC / CVE-2026-43500, Fragnesia, PinTheft / CVE-2026-43494, DirtyDecrypt / CVE-2026-31635); FD-theft via SUID exit-race (ssh-keysign-pwn / CVE-2026-46333). See coverage matrix for per-class rung detail.

Six defense-in-depth rungs in one dnf install: LD_PRELOAD shim, modprobe blacklists, per-unit systemd drop-ins, host-wide userns + ptrace + io_uring sysctls, auditd tripwires, and a read-only posture auditor. Auto-detection at install time suppresses any drop-in that would break a detected workload (IPsec, AFS, rootless containers, Flatpak, firejail, desktop browsers, Oracle RDS / HPC, io_uring consumers); every other layer stays active.

sudo curl -sSL https://rfxn.github.io/rfxn-defense/rfxn-defense.repo \
    -o /etc/yum.repos.d/rfxn-defense.repo
sudo rm -f /etc/yum.repos.d/copyfail.repo
sudo dnf upgrade -y rfxn-defense

Install

A single rfxn-defense.repo file works for EL7/EL8/EL9/EL10: dnf expands $releasever + $basearch per host. RPMs are GPG-signed and the metadata itself is verified via detached repomd.xml.asc (gpgcheck=1 + repo_gpgcheck=1).

sudo curl -sSL https://rfxn.github.io/rfxn-defense/rfxn-defense.repo \
  -o /etc/yum.repos.d/rfxn-defense.repo
sudo dnf install -y rfxn-defense
sudo /usr/sbin/rfxn-shim-enable

The 4-hourly auto-update cron (-autoupdate subpackage, pulled by the meta) keeps the host current; new mitigations land within 4 hours of a release tag with no operator action. Opt out by touching /etc/rfxn-defense/auto-update.disabled.

The meta pulls seven subpackages (-audit as soft dep on EL8/9/10, hard dep on EL7 since rpm-4.11 has no Recommends:):

Coverage matrix

Which rung blocks which bug class. ✓ = primary mitigation, applied without caveat; ✓ ⁿ = active coverage with a kernel- or workload-conditional caveat (see footnote); ⁿ alone = detection only, no mitigation (see footnote); · = not applicable.

¹ Catches the cksum step in the public DF-RxRPC PoC, not the kernel sink itself; defense-in-depth, not a primary stop.
² No-op on RHEL stock kernels (CRYPTO_USER_API* built-in). Supported workaround: grubby --update-kernel ALL --args "initcall_blacklist=algif_aead_init" + reboot.
³ Detection only, not mitigation. Telemetry for socket(AF_ALG/AF_KEY/AF_RXRPC/AF_RDS) and pidfd_getfd from unprivileged users. Highest value on hosts where modprobe blacklists are auto-suppressed (IPsec / AFS / Oracle RDS workloads) and the kernel sink stays reachable. Query via ausearch -k rfxn_{afalg,afkey,afrxrpc,afrds,pidfd_getfd}.
⁴ Functional on Ubuntu/Debian/Arch kernels and ELRepo kernel-ml swaps where rds.ko is loadable. No-op on stock RHEL/Alma/Rocky/Oracle UEK kernels (no CONFIG_RDS=m). Auto-suppressed on Oracle Grid / HPC hosts (signals: /etc/oratab, crsctl, loaded rds*.ko).
⁵ Auto-applied on Linux 6.6+ hosts where no io_uring workload is detected (liburing.so in /proc/*/maps, known-consumer binaries, io_uring-named systemd units). Suppressed on rootless / Flatpak / container-runtime hosts and kernels < 6.6. Override: CFD_FORCE_IOURING_DISABLE=1 rfxn-redetect or CFD_SUPPRESS_IOURING_DISABLE=1 rfxn-redetect.
⁶ DirtyDecrypt (CVE-2026-31635, rxgk_* RXGK token-decrypt in-place crypto) is cross-stamped onto the DF-RxRPC column: every AF_RXRPC mitigation that covers DF-RxRPC also covers DirtyDecrypt.

Audit keys (-audit subpackage)

Rules ship at /etc/audit/rules.d/99-rfxn-defense.rules with auid≥1000 filter on every key. The auditor probes page-cache integrity for /usr/bin/su, /usr/libexec/openssh/ssh-keysign, and the PAM stacks each class targets, as a cached-IOC for an in-flight exploit. See --json posture.bug_classes[*].kernel_sink.

Operator-applied (auditor-recommended)

Flagged via --emit-remediation; no subpackage applies them, since each can break legitimate workloads on a busy fleet. Review before pasting.

Auto-detection of conflicting workloads

The installer inspects the host in %posttrans and suppresses any drop-in that would break a detected workload. Every other layer stays active. The cf1 LD_PRELOAD shim and audit tripwires are never suppressed, so cf1 (CVE-2026-31431) coverage is unchanged on every host.

Detection signals and suppression

False-positive guards: /etc/subuid populated by useradd is not a rootless signal (shadow-utils auto-populates it for every regular user, which produced ~100% FPs on cPanel-shaped fleets in v2.0.1 rev 1). Rootful container signal requires mtime < 90d. /home walk bounded (maxdepth 6, mtime -180). /run/user/<UID>/containers requires UID ≥ 1000.

Inspect the decision

sudo cat /var/lib/rfxn-defense/auto-detect.json
sudo journalctl -t rfxn-defense-detect --since today
sudo rfxn-local-check --json | jq '.posture.auto_detect'

auto-detect.json (schema v2) lists detected.<workload>.signals, suppressed.<dropin>, and applied.<dropin> flags for every drop-in the installer manages. Detection runs in %posttrans after every install/upgrade and on demand via rfxn-redetect.

Re-detect or force full coverage

# Re-run detection after enabling IPsec/AFS/rootless post-install
sudo /usr/sbin/rfxn-redetect
sudo systemctl daemon-reload
sudo systemctl try-reload-or-restart sshd.service
sudo sysctl --system   # if any sysctl drop-in was added or removed

# Skip detection entirely - apply every drop-in unconditionally
sudo mkdir -p /etc/rfxn-defense
sudo touch /etc/rfxn-defense/force-full
sudo /usr/sbin/rfxn-redetect

The auditor reports force-full sentinel active when the sentinel is on. Remove the file and re-run rfxn-redetect to re-engage detection.

Verify

# cf1: AF_ALG socket creation should fail
python3 -c 'import socket; socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)'
# expect: PermissionError [Errno 1] Operation not permitted

# ssh-keysign-pwn: ptrace_scope should be 2 on hardened host
cat /proc/sys/kernel/yama/ptrace_scope
# expect: 2

# Holistic per-class coverage report
sudo rfxn-local-check
# tail-of-output:
#   Surface area / mitigation matrix:
#     Class                  Sink reachable?  Mitigated?  Active layers
#     cf1 (CVE-2026-31431)   YES              yes         ld_preload_shim, systemd_af_alg, modprobe_blacklist
#     cf2 (xfrm-ESP)         YES              yes         modprobe_blacklist, systemd_restrict_ns
#     Dirty Frag-ESP         YES              yes         modprobe_blacklist, systemd_restrict_ns
#     Dirty Frag-RxRPC       YES              yes         modprobe_blacklist, systemd_af_rxrpc
#     PinTheft (AF_RDS)      YES              yes         rds_modprobe, af_rds_restrict, rfxn_afrds
#     keysign-pwn (ptrace)   YES              yes         ptrace_scope, rfxn_pidfd_getfd

Override paths

systemd drop-ins use the standard layered-override pattern: within a <unit>.service.d/ directory, files merge in lex order and lower numbers lose to higher numbers for =value directives. rfxn-defense ships at 10-, 12-, 15-; operator escape hatches sit at 20- and 25-.

20-override.conf (neutralize a directive). Empty = clears the union for list-valued directives. Survives package upgrade (operator-owned, RPM does not manage it):

sudo install -d /etc/systemd/system/user@.service.d
sudo tee /etc/systemd/system/user@.service.d/20-override.conf >/dev/null <<'EOF'
[Service]
RestrictNamespaces=
RestrictAddressFamilies=
EOF
sudo systemctl daemon-reload

25-additions.conf (add a directive on top of ours). Sorts after 20-:

sudo tee /etc/systemd/system/sshd.service.d/25-additions.conf >/dev/null <<'EOF'
[Service]
NoNewPrivileges=true
EOF
sudo systemctl daemon-reload
sudo systemctl try-reload-or-restart sshd.service

modprobe override: conditional cf2-xfrm.conf and rxrpc.conf are managed by detect.sh (cmp-and-skip). Hand-edit and detect.sh logs a WARN on the next %posttrans/rfxn-redetect and preserves your edits. The always-on cf1.conf is %config(noreplace). Do not chattr +i a managed file: it breaks dnf via EPERM on install -m 0644.

Auditor JSON (v2.0 schema)

{
  "schema_version": "2.0",
  "covers": ["cf1", "cf2", "dirtyfrag-esp", "dirtyfrag-rxrpc", "pintheft", "keysign-pwn"],
  "posture": {
    "verdict": "vulnerable_kernel_userspace_mitigated",
    "bug_classes_covered": ["cf1", "cf2", "dirtyfrag-esp", "pintheft", "keysign-pwn"],
    "bug_classes": {
      "cf1":             { "applicable": true, "mitigated": true,  "layers": {} },
      "pintheft":        { "applicable": true, "mitigated": true,  "layers": { "rds_modprobe": true, "af_rds_restrict": true, "io_uring_disabled": true } },
      "keysign-pwn":     { "applicable": true, "mitigated": true,  "layers": { "ptrace_scope": true, "pidfd_getfd_auditd": true } }
    },
    "auto_detect": { "available": true, "suppressed_modprobe": [], "suppressed_systemd": [] }
  }
}

bug_classes_covered is the SIEM-ergonomic single filter ("is this host hardened?"). bug_classes exposes per-layer breakdown for finer dashboards. verdict and layers from v1.0.x are preserved for backwards compat. Exit codes (unchanged): 0 clean, 2 VULN, 3 VULN-but-mitigated, 4 hardening recommendations only.

Direct downloads

Each release on github.com/rfxn/rfxn-defense/releases ships per-EL binary RPMs, an SRPM, the .repo file, and the public signing key as release assets. v3.0.2 is the current line; older v3.0.0 / v3.0.1 / 2.0.x / 2.1.x RPMs are archived under repo/N/x86_64/archive/ in the dnf repodata so dnf upgrade resolves cleanly from any installed version.

The .repo file (works on EL7/EL8/EL9/EL10):

sudo curl -sSL https://rfxn.github.io/rfxn-defense/rfxn-defense.repo \
  -o /etc/yum.repos.d/rfxn-defense.repo

The public signing key (dnf imports automatically on first install; pre-import for offline verification):

sudo curl -sSL https://rfxn.github.io/rfxn-defense/RPM-GPG-KEY-rfxn \
  | sudo rpm --import /dev/stdin

Per-EL binary RPMs are independently compiled against each distribution's glibc (EL7: 2.17 split libdl; EL8: 2.28 split libdl; EL9/EL10: 2.34+ merged libdl). Do not cross-install across ELs.

EL7 (CentOS 7 / RHEL 7, vault.centos.org build)

EL8 (RHEL/Alma/Rocky/CentOS Stream 8)

EL9 (RHEL/Alma/Rocky/CentOS Stream 9)

EL10 (RHEL 10 / CentOS Stream 10 / AlmaLinux Kitten)

Signing

v1.0.1 and later are signed by the Copyfail Project Signing Key (retained as the project's canonical signing identity through the v3.0.0 rfxn-defense rename):

fingerprint: 6001 1CDC EA2F F52D 975A  FDEE 6D30 F32C D5E8 0F80
uid:         Copyfail Project Signing Key <proj@rfxn.com>
key file:    /RPM-GPG-KEY-rfxn
             (legacy alias: /RPM-GPG-KEY-copyfail, identical content)

The rfxn-defense.repo sets both gpgcheck=1 (verifies each RPM) and repo_gpgcheck=1 (verifies repomd.xml via the detached repomd.xml.asc we publish alongside it). dnf imports the public key from gpgkey= on first use.

Verify out-of-band:

curl -sSL https://rfxn.github.io/rfxn-defense/RPM-GPG-KEY-rfxn | gpg --import
gpg --fingerprint proj@rfxn.com
# expect: 6001 1CDC EA2F F52D 975A  FDEE 6D30 F32C D5E8 0F80
rpm --import https://rfxn.github.io/rfxn-defense/RPM-GPG-KEY-rfxn
rpm -K /path/to/rfxn-defense-3.0.2-1.el9.x86_64.rpm
# expect: digests signatures OK

Defense in depth

Each rung defeats the bug by a different mechanism, so an attack that defeats one does not necessarily defeat the next.

Where the shim itself fails (static binaries, direct syscall, SUID stripping) is attacker engineering territory. The other rungs fail under routine operator reality: vendors haven't shipped yet, the kernel was built with builtin crypto, the threat surface includes a cron job. That asymmetry is the case for deploying every rung.

Changelog

Per-release notes (full detail): github.com/rfxn/rfxn-defense/releases. Per-commit history: github.com/rfxn/rfxn-defense/commits.

Reporting issues

Bugs, packaging problems, false positives, missing distros: please file a GitHub issue. Include the auditor's --json output if the report is about detection, and the output of uname -a + cat /etc/os-release for any runtime question.