CHECKS-SETUID(8)

💅 check-setuid — NAME

okay bestie, meet check-setuid 💖 — she checks for changes to setuid programs. that's the whole vibe. that's her job. periodt.

---

✨ SYNOPSIS

check-setuid

no flags, no args, no drama. she just runs. iconic behavior honestly.

---

🦋 DESCRIPTION

so check-setuid is a plugin that gets run by the checksecurity command 🫶. what she does is scan your mounted filesystems (subject to the filter defined over in /etc/checksecurity.conf, iykyk) and compare the list of setuid programs against the list from the previous run. any changes? printed straight to standard output. no cap.

she also generates a list of nfs and afs filesystems that are mounted insecurely — and by "insecurely" we mean they're missing the nodev flag and either the noexec or nosuid flags 😭. like girl... that's giving exposed.

checksecurity gets run by cron on a daily basis, and the output is stored in /var/log/setuid/setuid.changes. so she's out here working the night shift, every night, quietly. main character energy fr fr.

---

🎀 CONFIGURATION

the checksecurity.conf file defines several configuration variables, and they are: CHECKSECURITY_FILTER, CHECKSECURITY_NOFINDERRORS, CHECKSECURITY_NONFSAFS, CHECKSECURITY_EMAIL, CHECKSECURITY_DEVICEFILTER, CHECKSECURITY_PATHFILTER, and LOGDIR. each one is described below, so let's get into it 💅

---

🌸 CHECKSECURITY_FILTER

the CHECKSECURITY_FILTER environment variable is the argument of 'grep -vE' applied to the output of the mount command. in other words, its value is a regular expression that removes matching lines from those file systems that will be scanned. lowkey powerful.

the default value removes all file systems of type proc, bind, msdos, iso9660, ncpfs, nfs, afs, smbfs, auto, ntfs, coda file systems, anything mounted on /dev/fd*, anything mounted on /mnt or /amd, and anything mounted with option nosuid or noexec. she's picky and honestly? she should be 💖

the checksecurity.conf file is sourced from checksecurity, so you could do some fairly tricky things to define CHECKSECURITY_FILTER. tricky how? bestie, that's between you and your shell 😌

---

💜 CHECKSECURITY_NOFINDERRORS

the CHECKSECURITY_NOFINDERRORS environment variable, if set to the literal string "TRUE", disables find errors from checksecurity. (actually, it re-routes them to /dev/null — same vibe, less mess 🙈)

---

🌈 CHECKSECURITY_NONFSAFS

the CHECKSECURITY_NONFSAFS environment variable, if set to the literal string "TRUE", disables the message about nfs and afs file systems that are mounted without the nodev and either the noexec or nosuid options. so if you already know, you can tell her to stop reminding you. valid.

---

🍓 CHECKSECURITY_EMAIL

if set, the CHECKSECURITY_EMAIL variable defines who is sent a copy of the setuid.changes file. yes queen, get the receipts delivered to your inbox 💌

---

👑 CHECKSECURITY_DEVICEFILTER

the CHECKSECURITY_DEVICEFILTER variable specifies a find clause for which matching block and character device files will not be monitored for changing owners and permissions. so like — if you don't want to check for permission changes on tty device files beneath /dev, you could set the following:

CHECKSECURITY_DEVICEFILTER='-path /dev/tty*'

⚠️ heads up bestie: any added or modified suid programs under that path would still be detected. the filter is not a free pass, it's just a narrow one 💀

if you want to specify multiple expressions, separate them with '-o', but there is no need to surround the whole clause with parentheses. to disable this filter, specify it as '-false' — which is the default, btw.

also, real talk: if the system gets restarted often, checksecurity will report a lot of changes in the /dev/ subdirectory due to timestamp changes 😭 in this case you might want to change it to:

CHECKSECURITY_DEVICEFILTER='-path /dev/'

---

🧚 CHECKSECURITY_PATHFILTER

the CHECKSECURITY_PATHFILTER variable specifies a find clause which will be pruned from the search path. this means the entire subtree will be completely skipped. gone. not even looked at. so, specifying

CHECKSECURITY_PATHFILTER='-path /var/ftp'

means the entire /var/ftp tree will be skipped ✨ to disable this filter, specify it as '-false' — which is, once again, the default.

---

⭐ LOGDIR

LOGDIR sets the name of the directory which stores the files that track the permission and ownership changes. by default, they are in /var/log/setuid. that's her little home. her apartment. her studio. 🏠

---

💖 FILES

• /etc/checksecurity.conf — checksecurity configuration file
• /var/log/setuid/setuid.today — setuid files from the most recent run
• /var/log/setuid/setuid.yesterday — setuid files from the previous run

---

🌟 the sign-off, bestie

this whole thing is from the Debian Linux manual, dated 2 February 1997 🎀 and yeah, she's been out here doing this since before you were born, and she is still slaying. no cap. go check your setuid programs. 💅✨