I just read Susan Bradley's post asking why we don't use a program hashes to only allow desktop's to run certain binaries. This got me thinking about my friend and lab mate Yusuf's project, "Kernel-based Cryptographic Pre-execution Validation of ELF Object Code". His project looks to be very promising and a hugely usefull tool for any organisation running *nix boxes. Imagine only letting binaries that have been signed by the IT dept run. He is still in the early stages but making good progress. As an extension it would probally be fairly trivial to do what Susan is asking and only allow binaries with certain hashes run. I will ask him.