#
# This is the checksecurity script configuration file
#
# These configuration variables mabye set:
# 
#     CHECKSECURITY_FILTER
#     CHECKSECURITY_NOFINDERRORS
#     CHECKSECURITY_DISABLE
#     CHECKSECURITY_NONFSAFS
#     CHECKSECURITY_EMAIL
#     CHECKSECURITY_DEVICEFILTER
#     CHECKSECURITY_PATHFILTER
#     LOGDIR
# 
# Each is described in it's own section below -- search for ####
# as a section divider.
#
####
#
# The CHECKSECURITY_FILTER variable is used as an argument to
# "grep -vE" to filter lines from the output of the "mount"
# command. 
#
# The default is not check the following file systems:
#
#   type proc
#   type msdos
#   type iso9660
#   type ncpfs
#   type smbfs
#   type nfs
#   type afs
#   type auto (They'll typically be picked up on the nfs branch)
#   type ntfs
#   type coda (similar to afs)
#   type usbdevfs
#   type none (--bind mounts)
#
#   floppies (i.e. /dev/fd<whatever>)
#   anything on /mnt or /amd
#
# Note that behaviour for nfs/afs has changed as of release -45. We
# no longer run find across nfs/afs disks; instead we simply report
# afs/nfs disks that are mounted insecurely (without -onosuid|noexec,nodev).
# You can disable this report by going setting the CHECKSECURITY_NONFSAFS 
# variable below.
#
# Use temp variables to build up CHECKSECURITY_FILTER, to make it
# a little more readable.
#
CS_NFSAFS='(nfs|afs|coda)'
# Uncomment the next line to get the old behaviour.
#CS_NFSAFS='(nfs|afs) \(.*(nosuid|noexec).*nodev.*\)'
#
CS_TYPES=' type (auto|proc|msdos|fat|vfat|iso9660|usbdevfs|ncpfs|smbfs|ntfs|devpts|none|'$CS_NFSAFS')'
#
CS_OPTS='\(.*(nosuid|noexec).*\)'
#
CS_DEVS='^/dev/fd'
#
CS_DIRS='on /mnt'
#
CHECKSECURITY_FILTER="$CS_TYPES|$CS_OPTS|$CS_DEVS|$CS_DIRS"
#
# Clear the temporary variables
#
unset CS_NFSAFS CS_TYPES CS_DIRS CS_OPTS
#
####
#
# The CHECKSECURITY_NOFINDERRORS, if set to "TRUE" (case sensitive),
# redirects any errors from the find command used in checksecurity
# to /dev/null.
#
CHECKSECURITY_NOFINDERRORS="FALSE"
####
#
# The CHECKSECURITY_DISABLE, if set to "TRUE" (case sensitive),
# disables the running of checksecurity
#
CHECKSECURITY_DISABLE="FALSE"
####
#
# The CHECKSECURITY_NONFSAFS, if set to "TRUE" (case sensitive),
# disables the message about insecurely mounted nfs/afs disks
#
CHECKSECURITY_NONFSAFS="FALSE"
####
#
# If the CHECKSECURITY_EMAIL is set, the report is mailed to the given
# address. Note that if you set this, it is *assumed* that you have
# /usr/bin/mail that accepts -s; the mailx package provides this; or
# you can install mutt and create a link, or some other
# alternative. No, I'm not going to fix it to write the appropriate
# headers and use sendmail (although I'd consider patch), nor am I
# going to add a {Depends|Recommends|Suggests} to the cron package.
# Do not submit bugs about this unless you include the above mentioned
# patch. You enabled this option -- you take responsibility.
#
#CHECKSECURITY_EMAIL="root"
####
#
# The CHECKSECURITY_DEVICEFILTER lets you tell find not to report
# devices in those directories (if you choose the daily Emails,
# devices like /dev/pts/?, /dev/tty?, or /dev/urandom will change
# often and clutter your mailbox) Note that these directories are
# still searched for suid executables.  Also not that *something* must
# be defined, which is why the default is "-false".
# Examples:
#CHECKSECURITY_DEVICEFILTER="-path /dev/*"
#CHECKSECURITY_DEVICEFILTER="-path /dev/* -o -path /home/ftp/dev/*"
CHECKSECURITY_DEVICEFILTER="-false"
####
# The CHECKSECURITY_PATHFILTER variable lets you set a pattern of
# pathnames that you don't want to check at all. You hopefully know
# what you're doing if you do this :-).
# Example:
# CHECKSECURITY_PATHFILTER="-path /dev/rd* -o -path /var/home/ftp*"
CHECKSECURITY_PATHFILTER="-false"
####
#
# Location of setuid file databases. Probably should
# be in /var/lib/cron, but I don't want to move them now. After
# the release, maybe.
#
LOGDIR=/var/log
