LID

LID (Linux Integrity Drift) is a tool designed to systematically identify kernel code paths that bypass Linux Security Module (LSM) hooks, thereby exposing visibility gaps in security policies without breaching the security guarantees of the LSM framework. It provides detailed insights into what security-sensitive operations are not evaluated by the LSM, affecting compliance and forensic capabilities. Notable features include distinguishing between visibility gaps and practical escalation paths, offering a nuanced understanding of potential security weaknesses in Linux environments.