The Samhain Host Integrity Monitoring System | ||
---|---|---|
Prev | Appendix C. Configuration file syntax and options | Next |
Section heading:
[Kernel]
Entries:
KernelCheckActive=boolean — 'true' to switch on, 'false' to switch off.
KernelCheckInterval=seconds — Interval between checks.
KernelCheckIDT=boolean — Check the Interrupt Descriptor Table (linux, default true).
KernelCheckPCI=boolean — Check PCI expansion ROMs (linux, default true).
KernelCheckPROC=boolean — Check proc file system (3.0.11+, linux, default true).
SeverityKernel=severity — Severity for events.
KernelSystemCall = address — the address of system_call (grep system_call System.map)
KernelSyscallTable = address — the address of sys_call_table (grep ' sys_call_table' System.map)
KernelProcRoot = address — the address of proc_root (grep ' proc_root$' System.map)
KernelProcRootIops = address — the address of proc_root_inode_operations (grep proc_root_inode_operations System.map)
KernelProcRootLookup = address — the address of proc_root_lookup (grep proc_root_lookup System.map)