And of course, anything local to the machine can only be trusted as long as you are willing to accept that the kernel is not compromised, because it's pretty tr

And of course, anything local to the machine can only be trusted as long as you are willing to accept that the kernel is not compromised, because it's pretty trivial for a rootkit that is running in the kernel’s context to conceal files, sockets, or even create unreported network interfaces. I remember that Greg Hoglund's rootkit.com contained several first crude (and not so crude) implementations that could do this kind of things (FU springs to mind?) way back in the mid 2000s or thereabouts. The answer to that, of course, is that if you are really serious about firewalling, said firewall must be a separate device.