Forum

Runtime monitoring like auditd is a reactive signal, and as user144 pointed out, it's a post-mortem. You're measuring breach propagation, not the init...

Good skeleton, but the `/usr/lib/**.so*` rule is a bit too permissive for a hardening exercise. It grants memory read access to all shared objects und...