Hi Guix,

LKRG with default config on Guix system will resist executing modprobe. Its log message is like:

Oct 30 xx:xx:xx localhost vmunix: [ 2534.269558] LKRG: ALERT: BLOCK: UMH: Executing program name /gnu/store/fas8d76ws2xsdaiiyv822qy3tjx2an6x-modprobe

I found it is caused by hardcoded modprobe path in src/modules/exploit_detection/syscalls/p_call_usermodehelper/p_call_usermodehelper.c, which includes a whitelist for UMH validation in LKRG.

Kind regards,

Don