5. Excluding files and/or subdirectories (All except...)

5. Excluding files and/or subdirectories (All except...)
Prev	Chapter 5. Configuring samhain, the host integrity monitor	Next

5. Excluding files and/or subdirectories (All except...)

To exclude individual files from a directory, place them under the policy IgnoreAll. Note that the existence of such files will still be checked (see next section).

To exclude subdirectories from a directory, place them under the policy IgnoreAll with an individual recursion depth of -1(see Section 4.5 ).

Note

	Note
Changes in a directory may also modify the directory inode itself (i.e. the special file that holds the directory information). If you want to check all but a few files in a directory (say, `/etc`), and you expect some of the excluded files to get modified, you should use a setup like: [ReadOnly] # dir=/etc # [Attributes] # # less restrictive policy for the directory file itself # file=/etc # [IgnoreAll] # # exclude these file and directories # file=/etc/resolv.conf.save dir=-1/etc/calendar #

Changes in a directory may also modify the directory inode itself (i.e. the special file that holds the directory information). If you want to check all but a few files in a directory (say, /etc), and you expect some of the excluded files to get modified, you should use a setup like:

	    [ReadOnly] 
	    #
	    dir=/etc 
	    # 
	    [Attributes] 
	    # 
	    # less restrictive policy for the directory file itself 
	    # 
	    file=/etc 
	    # 
	    [IgnoreAll] 
	    # 
	    # exclude these file and directories 
	    #
	    file=/etc/resolv.conf.save 
	    dir=-1/etc/calendar
	    #

Prev	Up	Next
4. Defining file check policies: what, and how, to monitor	Home	6. Timing file checks