NAME

       check-setuid - check for changes to setuid programs

SYNOPSIS

       check-setuid

DESCRIPTION

       The  check-setuid  is  a  plugin  run  by  the  checksecurity command. It scans the mounted files systems
       (subject to the filter defined in /etc/checksecurity.conf) and compares the list of  setuid  programs  to
       the  list  created  on the previous run. Any changes are printed to standard output. Also, it generates a
       list of nfs and afs filesystems that are mounted insecurely (i.e. they are missing the nodev  and  either
       the noexec or nosuid flags).

       checksecurity is run by cron on a daily basis, and the output stored in /var/log/setuid/setuid.changes.

CONFIGURATION

       The    checksecurity.conf   file   defines   several   configuration   variables:   CHECKSECURITY_FILTER,
       CHECKSECURITY_NOFINDERRORS,  CHECKSECURITY_NONFSAFS,   CHECKSECURITY_EMAIL,   CHECKSECURITY_DEVICEFILTER,
       CHECKSECURITY_PATHFILTER, and LOGDIR.  Each is described below.

       The  CHECKSECURITY_FILTER  environment variable which is the argument of 'grep -vE' applied to the output
       of the mount command. In other words, the value of CHECKSECURITY_FILTER  is  a  regular  expression  that
       removes  matching  lines from those file systems that will be scanned. The default value removes all file
       systems of type proc, bind, msdos, iso9660, ncpfs, nfs,  afs,  smbfs,  auto,  ntfs,  coda  file  systems,
       anything  mounted  on /dev/fd*, anything mounted on /mnt or /amd, and anything mounted with option nosuid
       or noexec.

       The checksecurity.conf file is sourced from checksecurity, so you could do some fairly tricky  things  to
       define CHECKSECURITY_FILTER.

       The  CHECKSECURITY_NOFINDERRORS  environment variable, if set to the literal "TRUE", disables find errors
       from checksecurity (actually, it re-routes them to /dev/null ).

       The CHECKSECURITY_NONFSAFS environment variable, if set to the literal "TRUE", disables the message about
       nfs and afs file systems that are mounted without the nodev and either the noexec or nosuid options.

       If set, the CHECKSECURITY_EMAIL variable defines who is sent a copy of the setuid.changes file.

       The  CHECKSECURITY_DEVICEFILTER  variable  specifies a find clause for which matching block and character
       device files will not be monitored for changing owners and permissions. For example, if you don't want to
       check for permission changes on tty device files beneath /dev, you could set the following:

              CHECKSECURITY_DEVICEFILTER='-path /dev/tty*'

       Note  that  any  added  or modified suid programs under that path would still be detected. If you want to
       specify multiple expressions, separate them with '-o', but there is no need to surround the whole  clause
       with parentheses. To disable this filter, specify it as '-false' (which is the default).

       Note  that  if  the  system  gets restarted often checksecurity will report a lot of changes in the /dev/
       subdirectory due to timestamp changes. In this case you might want to change it to:

              CHECKSECURITY_DEVICEFILTER='-path /dev/'

       The CHECKSECURITY_PATHFILTER variable specifies a find clause which will be pruned from the search  path.
       This means that the entire subtree will be completely skipped.  Thus, specifying

              CHECKSECURITY_PATHFILTER='-path /var/ftp'

       then  the  entire /var/ftp tree will be skipped. To disable this filter, specify it as '-false' (which is
       the default).

       LOGDIR sets the name of the directory which stores the files which track  the  permission  and  ownership
       changes. By default, they are in /var/log/setuid.

FILES

       /etc/checksecurity.conf
              checksecurity configuration file

       /var/log/setuid/setuid.today
              setuid files from the most recent run

       /var/log/setuid/setuid.yesterday
              setuid files from the previous run