luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Expand rootkit monitoring and Claude docs

Browse source
This commit is contained in:
Luna 2026-06-12 04:57:11 -07:00
parent a7129e5666
commit 3e5f8fc3f7
16 changed files with 524 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

6
config/enodia-sentinel.toml
View file

@ -87,10 +87,14 @@ pkgdb_pkgverify_sample = 40 # packages verified per pass (rotates)
# --- anti-rootkit cross-view --------------------------------------------
# Ask the same question two ways and diff the answers: kill(0) vs /proc for
# hidden processes, /sys/module vs /proc/modules for hidden LKMs, /proc/net/tcp
# vs ss for hidden listeners, and interface flags for promiscuous sniffing.
# vs ss for hidden TCP/UDP listeners, interface flags for promiscuous sniffing,
# known rootkit module names, per-module taint, and global kernel taint.
rootcheck_enabled = true
rootcheck_interval = 300 # seconds between cross-view sweeps
rootcheck_pid_cap = 65536 # upper PID to brute-force via kill(0)
# Legitimate tainted modules you accept (exact module names), e.g. a vendor GPU
# or virtualization driver. Known rootkit module names are never suppressed here.
rootcheck_module_allow = []
# --- incident grouping ---------------------------------------------------
# Collapse related alerts into one incident: process-lineage first (shared PID