CHECKSECURITY(8)

NAME
checksecurity - check for changes to setuid programs

SYNOPSIS
checksecurity

DESCRIPTION
The checksecurity command scans the mounted files systems (subject to the filter defined in /etc/checksecurity.conf) and compares the list of setuid programs to the list created on the previous run. Any changes are printed to standard output.

checksecurity is run by cron on a daily basis, so typically changes would be mailed to root.

CONFIGURATION
The checksecurity.conf file defines three configuration variables: CHECKSECURITY_FILTER, CHECKSECURITY_NOFINDERRORS, and CHECKSECURITY_DISABLE.

The CHECKSECURITY_FILTER environment variable which is the argument of 'grep -vE' applied to the output of the mount command. In other words, the value of CHECKSECURITY_FILTER is a regular expression that removes matching lines from those file systems that will be scanned. The default value removes all file systems of type proc, msdos, sio9660, ncpfs, and smbfs file systems, nfs and afs file systems that are mounted with the nodev and either noexec or nosuid options, anything mounted on /dev/fd*, and anything mounted on /mnt or /amd.

The checksecurity.conf file is sourced from checksecurity, so you could do some fairly tricky things to define CHECKSECURITY_FILTER.

The CHECKSECURITY_NOFINDERRORS environment variable, if set to the literal "TRUE", disables find errors from checksecurity (actually, it re-routes them to /dev/null ).

The CHECKSECURITY_DISABLE environment variable, if set to the literal "TRUE", disables checksecurity entirely, as a sop to those who think it's safe to allow random mounting of NFS and AFS disks without the nosuid or noexec flags.

FILES

/etc/checksecurity.conf
    checksecurity configuration file

/var/log/setuid.today
    setuid files from the most recent run

/var/log/setuid.yesterday
    setuid files from the previous run