SXID(1)

📦 version 4.20130802, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 SXID(1) — like, the manual page, bestie 💖

okay so this is sxid, a General Commands Manual page, and it is genuinely one of my faves because it is just a lil guy that watches your suid/sgid files for you. no cap. 🫶

✨ NAME ✨

sxid — check for changes in s[ug]id files and directories 💅

🎀 SYNOPSIS 🎀

sxid [-c, --config file] [-n, --nomail] [-k, --spotcheck]
     [-l, --listall] [-h, --help] [-V, --version]

🌸 DESCRIPTION 🌸

so basically sXid checks for changes in suid and sgid files and directories, and it does that by comparing against its last check. the receipts (logs) live in /var/log/sxid.log by default. then it emails all those changes to whatever address you put in the configuration file. 📬

the config file chills at /etc/sxid.conf by default, but you can absolutely override that with the --config option and point it at an alternate file. iconic behavior honestly.

💅 OPTIONS 💅

  • -c, --config file — tells it to use an alternate configuration file. you're the main character, you pick the file.
  • -n, --nomail — sends the output to stdout instead of emailing it. lowkey so useful for spot checks. ✨
  • -k, --spotcheck — checks for changes by recursing the current working directory. log files will not be rotated and no email gets sent. all output goes to stdout. 🦋
  • -l, --listall — super handy when you're doing --spotcheck or --nomail, because it lists all the files that are logged, regardless of changes. periodt.
  • -h, --help — displays a brief help message. 🎀
  • -V, --version — prints the version and exits. bye bestie! 👋

🔥 OUTPUT 🔥

the program outputs several different checks concerning the current status of the suid and sgid files and directories on the system where it was run. this is a basic overview of the format, ok? don't come for me.

in the add remove section, new files get a + in front, and old ones get a - in front. and like — note that "removed" does not mean gone from the filesystem, it just means it is no longer sgid or suid. it's still there, it's just not doing that anymore. 🙈

most of it is pretty easy to understand, ngl. on the sections that show changes in the file's info (uid, gid, modes...) the format is old->new. so if the old owner was mail and it is now root then it shows it as mail->root. simple as. 💜

the list of files in the checks is in the following format:

/full/path   *user.group   MODE

and MODE is the 4 digit mode, as in 4755.

in the changes section, if the line is preceded by an i then that item has changed inodes since the last check (regardless of any s[ug]id change). if there's an m then the SHA-256 checksum has changed. 👑

if a user or group entry is preceded by a * then its execution bit is set (ie. *root.wheel is suid, root.*wheel is sgid, *root.*wheel is +s). iykyk. ✨

on the forbidden directories, if ENFORCE is enabled an r will precede forbidden items that were successfully -s'd, and an ! will show that it was unsuccessfully -s'd (for whatever reason). it's giving attempt was made. 💀

💖 AUTHOR 💖

Ben Collins <bcollins@debian.org>

🫶 REPORTING BUGS 🫶

Timur Birsh <taem@linukz.org>

🌈 SEE ALSO 🌈

sxid.conf(5)

okay that's the whole thing bestie, we ate. this page is from Debian, dated July 29, 2013, and honestly? it still serves. stay safe out there and go check your suid files. mwah. 💅🎀✨

📦 where this page comes from