luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Expand rootkit monitoring and Claude docs

Browse source
This commit is contained in:
Luna 2026-06-12 04:57:11 -07:00
parent a7129e5666
commit 3e5f8fc3f7
16 changed files with 524 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

5
enodia_sentinel/cli.py
View file

@ -74,7 +74,7 @@ def main(argv: list[str] | None = None) -> int:
pv.add_argument("--sample", type=int, default=0,
help="packages to verify (0 = config default; rotates)")
sub.add_parser("rootcheck",
help="anti-rootkit cross-view: hidden procs/modules/ports")
help="anti-rootkit cross-view and kernel/module taint checks")
st = sub.add_parser("status", help="print daemon health/alert summary")
st.add_argument("--json", action="store_true", help="emit status as JSON")
inc = sub.add_parser("incident",
@ -197,7 +197,8 @@ def _cmd_rootcheck(cfg: Config) -> int:
from . import rootcheck
alerts = list(rootcheck.run(cfg))
if not alerts:
print("Rootcheck: no hidden processes, modules, ports, or sniffers found.")
print("Rootcheck: no hidden processes/modules/ports, sniffers, "
"known rootkit modules, or kernel taint found.")
return 0
for a in sorted(alerts, key=lambda x: -x.severity):
print(f"[{a.severity}] {a.signature:<22} {a.detail}")