C.7. Checking for SUID/SGID files

Section heading:

[SuidCheck]

Entries:

SuidCheckActive=boolean — '1' to switch on, '0' to switch off.

SuidCheckExclude=path — A directory (and its subdirectories) to exclude from the check. Only one directory can be specified this way.

SuidCheckSchedule=schedule — Crontab-like schedule for checks.

SeveritySuidCheck=severity — Severity for events.

SuidCheckFps=fps — Limit files per seconds for SUID check.

SuidCheckNosuid=boolean — Check filesystems mounted as nosuid. Defaults to not.

SuidCheckQuarantineFiles=boolean — Whether to quarantine files. Defaults to not.

SuidCheckQuarantineMethod=0|1|2 — Quarantine method. Delete = 1, remove suid/sgid flags = 1, move to quarantine directory = 2. Defaults to 1 (remove suid/sgid flags).

SuidCheckQuarantineDelete=boolean — Whether to delete rather than truncate, if method 0 (delete) is chosen. Default is truncate.