sebek as a patch?

NAHieu <[email protected]> Fri, 23 Sep 2005 20:43:59 +0900
Newsgroups gmane.comp.security.honeypots
Message-ID <[email protected]>
Hi,

One problem of sebek is it is rather hard to hide it in kernel module
list (Imagine that the attacker has root access). I guess the problem
can be improved if we patch sebek directly into linux kernel, so sebek
is built in, and not run as module.

But I cannot find such a patch: the only code I found at sebek
homepage is kernel module code. Could anybody tell me if there is such
a patch floating around?

Many thanks,
NAH