apk-audit(8)

🌸 NAME 🌸

okay so this is apk-audit(8) from the System Manager's Manual, and it's giving audit directories for changes — that's literally the whole vibe. the command is apk audit, and yes bestie, it audits directories for changes. 💅

✨ SYNOPSIS ✨

apk audit [<options>...] directories...

you give it <options>... if you want them, then one or more directories... to audit. periodt.

🦋 DESCRIPTION 🦋

apk audit audits the system or specified directories for changes compared to the package database. it's comparing your disk reality to the package-database receipts, and the results are the whole point.

The audit can be done against configuration files only (--backup) to generate a list of files needed to be stored in the overlay in run-from-tmps configuration. Alternatively, it can audit all installed files (--system or --full) to e.g. detect unauthorized modifications of system files. iconic behavior, honestly.

By default, the output format is one file per line, for each modified file. A character is printed indicating the line type, followed by a space, then the affected path or details. The changes detected are:

• - — Database detail record
• + — On-disk detail record
• A — File added
• d — Directory added
• D — Directory added (with non-listed files/subdirs)
• e — error occurred during audit (e.g. no permissions to read file)
• M — File metadata changed (uid, gid, or mode)
• m — Directory metadata changed
• U — File contents modified
• X — File deleted
• x — xattrs changed

💅 OPTIONS 💅

• --backup — audit configuration files only (this is the default, bestie). The list of files to be audited is generated from the masks in protected_paths.d. 🎀
• --check-permissions — check file permissions too. Namely, the uid, gid, and file mode will be checked in addition to the file content. locked in. 🔐
• --details — enable reporting of detail records.
• --full — same as --system, but in addition it reports all added directories and files. A built-in default override for protected paths is used, unless a --protected-paths is explicitly specified.
• --ignore-busybox-symlinks — ignore symlinks whose target is the busybox binary.
• --packages — print only the packages with changed files. Instead of the full output for each modification, the set of packages with at least one modified file is printed. To repair all packages with modified files, one could use: apk audit --packages -q | xargs apk fix
• --protected-paths FILE — use the given FILE for protected paths listings. This also makes apk ignore the regular protected_paths.d directories.
• --recursive, -r — descend into directories and audit them as well.
• --system — audit all system files. All files provided by packages are verified for integrity with the exception of configuration files (listed in protected_paths.d). This is useful for detecting unauthorized file changes. New files or directories are not reported.

🔥 SEE ALSO 🔥

apk-protected_paths(5) — go read it for the protected-paths lore, iykyk. 🦋

---

that's the tea, bestie 🫶 this was apk-audit(8) from the System Manager's Manual, dated 2026-11-02. now go audit those directories and stay iconic. 💖✨🎀