Protecting Files with Client Settings
When any file is now marked as protected (|protect|) in the client settings, that file is protected from being modified or deleted, (even from a root process).
Note
The file is not guarded and it can be external to a GuardPoint.
Previously, the only files that were protected were the following:
/etc/passwd
/etc/group
/etc/security/passwd
/etc/ssh/sshd_config
/etc/ssh/sshrc
/opt/testfile
If the file marked as |protect| does not exist, then CipherTrust Transparent Encryption creates a 0-length file in its place. This provides an efficient means to identify and implement file protection. When the agent is stopped or uninstalled, these 0-length files are deleted and then re-created if the agent is restarted. Additionally, an audit record is generated when a file operation is denied.
The |protect| status is displayed using secfsd -status auth.
