preventing /dev/kmem and /dev/mem writes?

[campbellm@cia.com.au]

Hi,

I have a machine that has been the unfortunate victime of SuckIT
r00tkit. As this exploit relies on writing to /dev/kmem, I was thinking
of making /dev/mem and /dev/kmem unwriteable. I have heard this breaks X
and some gdb functions, but does anyone know any other specific problems
this might have?

Cheers,

C.