lids is an intrusion detection system patch for the Linux kernel; it can protect important files from being changed. When it's in effect, no one (including root) can change the protected files or directories and their sub-directories, and the protected append-only files can only be appended. It can also protect the hard disk's MBR, and can also disallow sniffing while the NIC is in promiscuous mode.
14cc654b7767e4639cc0795dc2ccb827e3b21db6ca359e67d598f7d7fcbbb5a4