Securing Files and Verifying File Integrity in Oracle® Solaris 11.2

Exit Print View

Updated: July 2014
 
 

BART Rules File Format

Rules files are text files that consist of lines that specify which files are to be included in the manifest and which file attributes are to be included in the manifest or the report. Lines that begin with #, blank lines, and lines that contain white space are ignored by the tool.

    The input files have three types of directives:

  • Subtree directive, with optional pattern matching modifiers

  • CHECK directive

  • IGNORE directive

Example 2-5  Rules File Format
<Global CHECK/IGNORE Directives>
<subtree1> [pattern1..]
<IGNORE/CHECK Directives for subtree1>

<subtree2> [pattern2..]
<subtree3> [pattern3..]
<subtree4> [pattern4..]
<IGNORE/CHECK Directives for subtree2, subtree3, subtree4>

Note - All directives are read in order. Later directives can override earlier directives.

A subtree directive must begin with an absolute pathname, followed by zero or more pattern matching statements.

BART Rules File Attributes

The CHECK and IGNORE statements define which file attributes to track or ignore. The metadata that begins each manifest lists the attribute keywords per file type. See Example 2–1.

The all keyword indicates all file attributes.

BART Quoting Syntax

The rules file specification language that BART uses is the standard UNIX quoting syntax for representing nonstandard file names. Embedded tab, space, newline, or special characters are encoded in their octal forms to enable the tool to read file names. This nonuniform quoting syntax prevents certain file names, such as those containing an embedded carriage return, from being processed correctly in a command pipeline. The rules specification language allows the expression of complex file name filtering criteria that would be difficult and inefficient to describe by using shell syntax alone.

For more information, see the bart_rules(4) man page.