Re: [Integrit-users] sample conf

[Ed L C. <ec...@te...>]

matt <ma...@ci...> writes:

...
> 1/- what you specify as root is then checked recursively with all
> checks. You remove what you don't want checked, rather than add stuff
> that you do.

Yes, that's correct.  I'll make a note to make sure that's clear in
the docs.

> 2/- trailing slashes on checkset destinations result in nothing
> being checked.

Trailing slashes are not possible in a real UNIX filename or directory
name.  I'll check whether the docs warn against adding them.

> 3/- prefixes cannot be overridden.

Right.

> I think that the root.conf example in the examples directory should
> be changed, as it specifies at least 3 checksets that won't ever
> do anything because of point 3:
> 
> $ sed -n 58,62p examples/root.conf
> =/var/spool
> /var/log                SIMC
> /var/spool/cron         SIMC
> =/var/spool/mqueue
> /var/spool/mail         SIMC

That's a good point.  If you would like to send a patch to
integrit-devel, here's a helpful way to do it:

  wget http://prdownloads.sourceforge.net/integrit/integrit-2.02.02-beta.tar.gz
  tar xvfz integrit-2.02.02-beta.tar.gz
  cp integrit-2.02/examples/root.conf integrit-2.02/examples/root.conf.dist
  vi integrit-2.02/examples/root.conf
  diff -u integrit-2.02/examples/root.conf.dist integrit-2.02/examples/root.conf > root.conf-patch
  
-- 
--Ed Cashin                   PGP public key:
  ec...@te...       http://www.terry.uga.edu/~ecashin/pgp/