Sysfs Interface

Two-step interface using group file permissions to control rootkit features.

How It Works

Like git, changes require two steps:

  1. Stage change (chmod) - like git commit
  2. Apply change (cat/echo) - like git push
  chmod 670 /sys/kernel/epirootkit/control  # Stage features (group rwx)
cat /sys/kernel/epirootkit/control        # Apply changes

Permission Mapping

Group permission bits control features:

  • Bit 1 (group execute): Module hiding
  • Bit 2 (group write): File hiding
  • Bit 4 (group read): Line hiding

Usage Examples 

  # Enable all features
chmod 670 /sys/kernel/epirootkit/control  # Stage: group rwx (7)
cat /sys/kernel/epirootkit/control        # Apply

# Enable only module hiding  
chmod 610 /sys/kernel/epirootkit/control  # Stage: group --x (1)
echo "apply" > /sys/kernel/epirootkit/control  # Apply

# Disable everything
chmod 600 /sys/kernel/epirootkit/control  # Stage: group --- (0)
cat /sys/kernel/epirootkit/control        # Apply

Feature Combinations

chmodGroupModuleFilesLinesDescription
600—❌❌❌All disabled
610–x✅❌❌Module only
620-w-❌✅❌Files only
630-wx✅✅❌Module + files
640r–❌❌✅Lines only
650r-x✅❌✅Module + lines
660rw-❌✅✅Files + lines
670rwx✅✅✅All enabled

Status Output 

  cat /sys/kernel/epirootkit/control

Example:

  module_hidden=yes
file_hiding=yes  
line_hiding=yes

File Location 

  /sys/kernel/epirootkit/control

Two-step design ensures explicit control over when rootkit features activate.

Edit this page