Linux File Integrity Monitoring: Paths, Events, and Platform Limits

What 1-SEC checks

Runtime Watcher inspects reported file paths for sensitive locations and suspicious file patterns. Its file-integrity component and Linux-specific runtime observation paths have their own startup/configuration requirements. An empty or nonexistent watched path is covered by separate tests.

Read the implementation: handleFileEvent

Required telemetry and context

Relevant input events: file_change, file_modified, file_created. Use a trusted producer at the real application boundary.

• path
• host identity and process context from collector

Field names above describe relevant context, not a complete API request. Consult the current event contract for envelope and detail requirements. Preserve booleans, numbers, and strings as the receiving handler expects them. Agent-provided text cannot independently verify identity or authorization.

Deployment, prevention, and response

Establish a trusted baseline and identify legitimate package/configuration writers. Validate observation on the intended mount/container boundary. Preserve old/new evidence where available and restore through the service's controlled recovery process, not an assumption that an alert repaired the file.

Record the source event, affected agent/host, actual target, policy decision, and response result. Review enforcement configuration separately from detection. A recommendation, selected action, dry-run record, and completed action are different outcomes.

Reproduce the source fixtures

From a checkout of the linked 1-SEC source revision, run the selected fixtures with the repository's Go toolchain. These commands run tests; they do not execute a real attack against your systems.

go test ./internal/modules/runtime -run '^(TestWatcher_HandleEvent_SensitiveFile|TestFileIntegrityMonitor_EmptyPaths|TestFileIntegrityMonitor_NonexistentPath)$' -count=1

The referenced source fixtures ran in the selected local package suites. Helper tests and synthetic events establish only the assertions shown, not production prevention or framework compatibility.

func TestWatcher_HandleEvent_SensitiveFile(t *testing.T) {
	cp := makeCapturingPipeline()
	w := startedModuleWithPipeline(t, cp)
	defer w.Stop()

	ev := core.NewSecurityEvent("test", "file_modified", core.SeverityInfo, "file modified")
	ev.Details["path"] = "/etc/shadow"
	ev.SourceIP = "10.0.0.1"

	w.HandleEvent(ev)

	titles := cp.alertTitles()
	found := false
	for _, title := range titles {
		if title == "Sensitive File Modified" {
			found = true
			break
		}
	}
	if !found {
		t.Errorf("expected 'Sensitive File Modified' alert, got: %v", titles)
	}
}

func TestFileIntegrityMonitor_EmptyPaths(t *testing.T) {
	fim := NewFileIntegrityMonitor([]string{}, 5*time.Minute)
	fim.BaselineScan()
	changes := fim.Scan()
	if len(changes) != 0 {
		t.Errorf("expected 0 changes for empty paths, got %d", len(changes))
	}
}

func TestFileIntegrityMonitor_NonexistentPath(t *testing.T) {
	fim := NewFileIntegrityMonitor([]string{"/nonexistent/path/that/does/not/exist"}, 5*time.Minute)
	fim.BaselineScan()
	changes := fim.Scan()
	// Should not panic, just return empty
	if len(changes) != 0 {
		t.Errorf("expected 0 changes for nonexistent path, got %d", len(changes))
	}
}

// ─── HandleEvent Integration ──────────────────────────────────────────────────

Tuning, evaluation, and coverage limits

A sensitive-path alert does not establish the content change, author, or maliciousness of every write. Actual filesystem observation depends on platform support, accessible paths, permissions, and the configured watcher. Event inspection is not a universal filesystem rollback mechanism.

Evaluate this behavior with representative authorized activity and a controlled known-positive case. Investigate the exact rule, inputs, and state before suppressing an alert. Do not assume a hard-coded heuristic is a configurable setting. Measure your own deployment; the source fixtures do not establish a benchmark, detection rate, compliance certification, or incident-prevention claim.