Checking for kernel module rootkits

Samhain
Prev | Appendix C. List of configuration file options | Next

# C.6. Checking for kernel module rootkits

Section heading:

[Kernel]

Entries:

KernelCheckActive=`boolean` — 'true' to switch on, 'false' to switch off.

KernelCheckInterval=`seconds` — Interval between checks.

KernelCheckIDT=`boolean` — Check the Interrupt Descriptor Table (default true).

SeverityKernel=`severity` — Severity for events.

KernelSystemCall = `address` — the address of system_call (grep system_call System.map)

KernelSyscallTable = `address` — the address of sys_call_table (grep ' sys_call_table' System.map)

KernelProcRoot = `address` — the address of proc_root (grep ' proc_root$' System.map)

KernelProcRootIops = `address` — the address of proc_root_inode_operations (grep proc_root_inode_operations System.map)

KernelProcRootLookup = `address` — the address of proc_root_lookup (grep proc_root_lookup System.map)

Prev | Home | Next
Watching login/logout events | Up | Checking for SUID/SGID files