eBPF + LSM file integrity monitoring (Team+). Specifically blocks web shell writes / trojan drops / binary replacement.
Core idea
Not periodic scanning — kernel LSM hooks intercept every file write. Path in protected list + writer unauthorized → block + alert + audit.
Protected paths
- NodeKeeper binary / auth.lic / config.json / certs/
- ~/.ssh/authorized_keys (anti SSH backdoor)
- systemd unit files
- Website root_dir (optional, user-configured)
Performance
LSM hooks synchronously add < 1μs per call. Even tens of GB/s file IO not noticeable.