> What stops the attacker from just editing /etc/rc.securelevel and then doing a normal reboot? Certainly a full reboot leaves more tracks than no full reboot?

> What stops the attacker from just editing /etc/rc.securelevel and then doing a normal reboot? Certainly a full reboot leaves more tracks than no full reboot? So it's harder to hide?