Just a note to moderators. The rootkit outline I posted here:
security.stackexchange.com/questions/6218/… is not totally armed and dangerous. The ssytem call table changes per compiled version of the kernel, so every kernel update will break that compiled kernel module. Also, the lengths of pointers issue makes it non-portable between 32-bit and 64-bit kernels.