Supported Linux Versions

Officially supported versions by the latest Linux Agent build

There is a significant change with the introduction of ThreatLocker Linux Agent 3.0: it now uses an eBPF-based approach for implementing the Agent.

For Linux kernels 5.10 and above, eBPF will be utilized. All kernel versions starting from 5.10 will be supported by the corresponding package versions. For kernels below 5.10, the Agent will continue to use the LKM approach.

eBPF support table

LKM support table

To use ThreatLocker LKM-based Agent on Ubuntu systems, you need to meet the exact kernel version support. For example 4.15.0-126-generic, not 4.15.0 or 4.15.0-111

For correct error handling, you need to install curl on your Ubuntu system. 

Beta: A special Linux Agent build with limited functionality is available upon request

Kernel compatibility guidance for ThreatLocker's LKM-based Linux Agent 

ThreatLocker's Linux LKM-based agent is designed to operate only on specific, supported Linux kernel versions, with compatibility defined down to the exact kernel build number.

Installing the ThreatLocker LKM-based Agent on a supported kernel and subsequently updating the kernel to an unsupported version can lead to critical system instability, potentially rendering the machine inoperable.

If a kernel update to an unsupported kernel version is absolutely necessary, the ThreatLocker LKM-based Agent should be uninstalled before proceeding with the update to prevent system failure.

Steps before upgrading Ubuntu Linux kernels 5.13-5.15.0-52

You need to remove landlock LSM due to conflicts with eBPF LSM used by ThreatLocker Linux Agent. 

1) cat /sys/kernel/security/lsm

    If landlock is not in the list, you are done. 

2) Add bpf and remove landlock from lsm list:

Modify GRUB_CMDLINE_LINUX_DEFAULT in /etc/default/grub 

GRUB_CMDLINE_LINUX_DEFAULT="lsm=lockdown,capability,yama,apparmor,bpf"

3) sudo update-grub