I know tripwire. Biggest flaw its not real time. fanotify will allow that to be changed at least part of the way for file-system operations. Second big problem with tripwire is false positives. SELinux guarding services you most of the time don't even notice. Since distributions who did the SELinux system did it right in the first place. Yes SELinux has 3 basic modes. Off, Limited protection ie protect only items like services and god darn paranoid. God darm paranoid is what most people know and fear. Selinux has some reasonable front ends out there these days. No more annoying that putting up with zonealarm on windows. There is also smack if you don't particularly like Selinux both are peer reviewed. Martin I have never had a DBMS system I have not been able to make work with SELinux. Note SELinux programmers concidered everything. SELinux profile writers don't always. http://sourceforge.net/projects/segatex/ makes correcting policies quite simple. http:~user/... I have done that stuff with selinux in place. Some distributions have it work from the start line. There is a learning mode you can setup for selinux these days for odd ball problems. Its part having the right tools for the job Martin. MS released an so called anti-virus that used CRC32 checksums back in the WFW 3.11 time frame . Only one problem CRC32 checksums could be colided simply so it was rendered useless.
