0

With sudo lsof | grep mounted-drive-name I found that a find process is running on one of my hard drives which I'd like to spare.

With KDE's system monitor it shows me that it was started by anacron->checksecurity (the full process tree is: systemd->anacron->sh->run-parts->checksecurity->checksecurity->check-setuid->find and it is run by user root).

With that command I noticed that most of the time it scans through node_modules folders but also scans folders like ~/.config/chromium/Default/[...]. Afaik I didn't change anything in those folders at least since the last time that this has been running.

I'd like to know why that find process is getting periodically run, if it is useful (for me; and e.g. where one can find its results) and how to disable it (or configure it so that it scans only in a way that's useful).

I ran cat /proc/PID/status and ps -Flww -p PID which didn't yield a lot of info about it and couldn't find out if and how such(?) checksecurity scans are useful or whether they running properly.

4
  • one of the things that checksecurity does is look for insecure permissions (and, IIRC, suspicious filenames...or I might be confusing that with rkhunter). Anyway, to do that, it has to run find.
    – cas
    Jul 22, 2021 at 12:40
  • If that is the case how is it useful – i.e. how do I get its results? Via email to root or how? And still shouldn't it scan those files only once as they weren't changed afaik?
    – mYnDstrEAm
    Jul 22, 2021 at 13:27
  • how do you expect checksecurity to know if a file has changed or not if it doesn't look? magic? if it's no use to you, then don't install it.
    – cas
    Jul 22, 2021 at 13:56
  • @cas I didn't install it so it must have come with some other package (maybe Lynis). I didn't configure it either. No but there could be other ways then checking like keeping track of directories already checked and e.g. using modified-at metadata or hashsums of whole directories. In any case I'd like to prevent it from scanning on that drive all the time.
    – mYnDstrEAm
    Jul 23, 2021 at 12:52

1 Answer 1

3

It’s getting started by checksecurity because the checksecurity package sets up cron jobs to do so. If checksecurity identifies anything suspicious, it sends an email, by default to root — this can be configured in /etc/checksecurity.conf (and assumes a working, local email setup, which is rare nowadays).

The specific check which starts the find process you’ve identified is check-setuid. It has a manpage which describes it and its configuration options. You can exclude a given path by editing /etc/checksecurity/check-setuid.conf and adding the path to either CS_DIRS or CHECKSECURITY_PATHFILTER. You can see the logs of this particular check in /var/log/setuid.

4
  • checksecurity.conf has the default email configured but I didn't receive any emails to root@hostname from checksecurity (searched for that term in Thunderbird; at least since recently). Does this mean the scans aren't useful and I could disable them so they don't wear down the HDD? If not how to find the mails or make sure I receive them? I suspect they aren't useful because it looks like (haven't verified that) these are running even if the files haven't changed (and e.g. hashsums and modification dates should be the same as before).
    – mYnDstrEAm
    Sep 3, 2021 at 11:26
  • Do you have a local email setup? In any case, even if you don’t get any output currently, that doesn’t mean the scans aren’t useful: if your system ever was compromised and someone installed a setuid binary, and checksecurity wasn’t tampered with, you’d get an email telling you about it (or see something in the logs). I don’t think you should be particularly worried about wearing down your HDD, it’s not a problem in practice IME. Sep 3, 2021 at 12:27
  • Yes, it may be good to link a guide on how to enable it btw but I'm currently receiving root email via Thunderbird and there's lots of other log-mails but nothing from checksecurity (that's what I ctrl+f'd for). Alright, I leave it enabled and may look into ways it could be prevented from running long scans even if nothing has changed (e.g. checksums for whole directories to quickly detect changes/an unchanged state). One issue with the HDD is that sometimes I have HDDs connected that are in sleep mode but get woken up, accessed and written to only (or most frequently) by this scan.
    – mYnDstrEAm
    Sep 3, 2021 at 12:52
  • 1
    Ah right, if I find a good guide I’ll add a link to it, but it’s good to know you’re getting the emails ;-). Avoiding waking up drives is why I mentioned excluding paths (perhaps a better option would be to avoid scanning volumes on drives which are asleep, but that’s harder to determine) — using checksums won’t help because you’d still have to wake the drives up to determine that nothing has changed. Sep 3, 2021 at 12:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .