Can AIDE scan a directory inside a directory the user doesn't have read permissions for?

Question

I would like to use AIDE to help me verify the integrity of my home directory on a shared Linux system. I am not an administrator of this system. I have built and installed AIDE in my home directory and it seems to work properly.

The sysadmin has set permissions on /home to 0751. This allows users to enter /home, but not list the contents of the directory (an ineffective security measure, in my opinion).

For demonstration purposes, consider this overly simple aide.conf:

database=file:/home/kccricket/aide.db
database_out=file:aide.db.new
/home/kccricket R

Given this setup, running aide -i will output:

open_dir():Permission denied: /home

AIDE, version 0.15.1

### AIDE database at aide.db.new initialized.

The resulting AIDE database will be empty. If I run the same command with -V255 (highest verbosity), I can see that AIDE examines every directory in / and then attempts to do the same with /home. It chokes because it can't list the contents of /home.

Is there a way to make this work, short of asking the sysadmin to change the perms on /home?

Answer 1

The solution to this problem is to build AIDE from the current development snapshot or the 0.16a2 alpha release.

Version 0.16a2 includes a new option:

root_prefix
          The prefix to strip from each file name in the file system before applying
          the rules and writing to database. Aide removes a trailing slash from  the
          prefix.  The default is no (an empty) prefix. This option has no effect in
          compare mode.

In the case of this question, the new aide.conf file would be:

database=file:/home/kccricket/aide.db
database_out=file:aide.db.new
root_prefix=/home/kccricket
/ R

Thanks to Hannes von Haugwitz (hannes@vonhaugwitz.com) of the AIDE team for this information.

Answer 2

You can have aide limit it's scan to only the folder specified by appending a =.

Example with your configuration:

database=file:/home/kccricket/aide.db
database_out=file:aide.db.new
/home/kccricket R

Change the line /home/kccricket R to =/home/kccricket R

That will force aide to only scan inside the specified folder, and not take a peek outside causing a failure.