StJude is an attempt to monitor the flow of privilege in my Solaris boxes. It tries to detect privilege violations or improper transitions (ie stack smashing, or other local root exploits) by watching audit trails.
dc6a5beb02c0c8dca44693e6f1c02adb9803e196194e4af0c5cf6345de7cddae