the real kicker is the page cache trick making it invisible to disk-based integrity checks, which means your auditd and tripwire setups are worth exactly nothing here