On 5 Sep 2008 at 19:26, Andi Kleen wrote:

> 
> First such checkers already exist -- they are called root kit checkers.
> There are various around. 
> Usually operate from user space. You could run them in a cron job.

how trivial do you think it is for *kernel* code to evade *userland*
checking it? ;) otherwise agreed with rest.