SXID(5)

💖 SXID(5) — the file formats manual, but make it a group chat 💖

okay bestie so this is the sxid.conf page from section 5 of the manual (the file formats one, iykyk) — it's giving "configuration settings for sXid" and honestly it's so much less scary than it sounds. come sit with me. 🫶

---

🌸 NAME 🌸

sxid.conf — configuration settings for sXid ✨

---

🦋 DESCRIPTION 🦋

So this is the config file sXid reads to figure out its parameters for execution. Default location? /etc/sxid.conf. But bestie, it can be anything you want — just point at it with the --config command line option for sXid. main character energy, your file your rules. 💅

Options in this file go like this:

OPTION = "VALUE"

and ngl this is the part people mess up: the VALUE must be wrapped in double quotes. no quotes, no vibes, no service. 😭

---

✨ OPTIONS ✨

• ALWAYS_NOTIFY — if sXid doesn't find any changes, it will not send an email… unless you put "yes" here. that's the whole deal. so if you're the type who needs the "no news" text, this is your moment. 📧
• ALWAYS_ROTATE — usually sXid only rotates the log files when there's a change from the last run, and honestly? that's usually best, because then all the logs actually record a change instead of just recording that the program ran. but if you want the logs rotated every single time sXid runs, changes or not, specify "yes" here. icon behavior. 🔄
• EMAIL — where to send the email containing the output of changes every time sXid is run. example:

EMAIL = "System Administrator <sysadmin@example.com>"

• ENFORCE — normally sXid just flags items that are suid or sgid and sitting in a FORBIDDEN directory. with this set to "yes", sXid will straight up remove the s[ug]id bit(s) on any files or directories it finds in forbidden directories, and report any changes in the email. 💀

heads up: directories listed in FORBIDDEN are searched regardless of whether or not they're listed in SEARCH. however, the EXCLUDE option still applies to directories that fall under them.

• EXCLUDE — a space separated list of directories to exclude from the search. note that if a SEARCH path falls under an EXCLUDE path, it will still be searched — so this is perfect for excluding a whole directory and only specifying one. example:

SEARCH  = "/usr /usr/src/linux"
EXCLUDE = "/usr/src"

• EXTRA_LIST — a file that contains a list (each on its own line) of other files sXid should monitor. obsessed with this one for files that aren't +s but relate to system integrity (tcpd, inetd, apache…). example:

EXTRA_LIST = "/etc/sxid.list"

• FORBIDDEN — a space separated list of directories that are not supposed to contain any suid or sgid items. items that are suid or sgid in these directories get flagged in the email separately from the other listings, whether there are other changes or not. example:

FORBIDDEN = "/tmp /home"

• IGNORE_DIRS — ignore entries for directories in these paths. this means only files will be recorded. and yes bestie, you can effectively ignore all directory entries by setting this to "/". slay. 🎀
• KEEP_LOGS — a numerical value for how many log files to keep when rotating. just a number. that's it.
• LISTALL — forces a list of all entries to be included in the output. implies ALWAYS_NOTIFY. 💅
• LOG_FILE — the full path of where to store the log files. these get rotated, and each rotated log gets suffixed with a digit. the directories must already exist. this is usually /var/log/sxid.log. rotated logs would look like /var/log/sxid.log.n where “n” is the number in the rotation. the current log has no suffix. 🗂️
• MAIL_PROG — mail program. this changes the default compiled-in mailer for reports. you only need this if you've changed its location and don't want to recompile sXid. lazy girl win, no cap. 📮
• SEARCH — a space separated list of directories to search. sXid will use these as a starting point for its searches. example:

SEARCH = "/usr /bin /lib"

---

👑 AUTHOR 👑

Ben Collins <bcollins@debian.org>

---

🙈 REPORTING BUGS 🙈

Timur Birsh <taem@linukz.org>

---

🌈 SEE ALSO 🌈

sxid(1)

---

and that's the whole page, bestie, you ate that. this one came from Debian and it's dated July 29, 2013 — shoutout to the era that raised us. go forth and configure responsibly, fr fr. 💜✨