The Linux Intrusion Detection System is a Linux kernel patch and modules to enhance the Linux kernel's security. It can protect important files from being changed. When it's in effect, no one (including root) can change the protected files or directories and their sub-directories, and the protected append-only files can only be appended. It can prevent loaded modules from being unload, mounted filesystems from being unmount and lauched processes from being kill. It can also protect the hard disk's MBR, and can also disallow sniffing while the NIC is in promiscuous mode.