# This sample ninja(8) configuration file shows and explains all the available
# options, with all the values set to default.
#
# Use this file as a guide when creating your own configuration.
# DO NOT USE THIS CONFIGURATION AS IT IS!
#
# Configuration syntax:
#
#   <option> = <value>
#
# Both option and value are one word each.  No strings, no whitespace, etc.
# Boolean options (marked BOOL) takes the values "yes" or "true" and
# "no" or "false".
#
# The assignment symbol ('=') is ignored by the parser and can be ommited.


# Name: group
# Type: INTEGER
#
#   Sets the GID (Group ID) of the group of users that are allowed to run
#   any root setuid/setgid binary.  Users in this group does not need to be
#   whitelisted. 
group = 0


# Name: daemon
# Type: BOOL
#
#   If set to "yes", ninja will run in the background as a daemon.
daemon = no


# Name: interval
# Type: INTEGER
#
#   The process scanning interval, in seconds.  This is the amount of time
#   ninja will sleep, before going through all the active processes on the
#   system.  Lower intervals are safer, meaning that unauthorized processes
#   will be detected faster.  Unless your system is very slow, you should set
#   this to zero.
interval = 1


# Name: logfile
# Type: STRING
#
#   Path to log file.  If specified, all messages are logged to this file.
#   You really want to specify a log file if you are running ninja as a daemon.
logfile = (null)


# Name: whitelist
# Type: STRING
#
#   Path to the whitelist file.
whitelist = (null)


# Name: external_command
# Type: STRING
#
#   Path to the external command.  If you specify an external command, this
#   command will be run every time an unauthorized process is detected.  This
#   could be a script that alerts the admin of the system via e-mail,
#   disables the login account of the offending user, among other things.
#   The command will be run as <command> <user> where 'user' is the username
#   of the offending user.
external_command = (null) 


# Name: no_kill
# Type: BOOL
#
#   If this option is enabled, unauthorized processes will not be killed when
#   detected.  This can be very useful when testing the system, or when
#   creating whitelists.
no_kill = no


# Name: no_kill_ppid
# Type: BOOL
#
#   Same as the "no_kill" option, except this one affects the ppid, parent of
#   the unauthorized process.
no_kill_ppid = no


# Name: ignore_root_procs
# Type: BOOL
#
#   When this option is enabled, all processes spawned by root, meaning
#   processes with a parent process owned by root, will be ignored.  This
#   is generally a good idea, and will save us some cpu cycles.
ignore_root_procs = yes


# Name: log_whitelist
# Type: BOOL
#
#   If enabled, ninja will log everytime it detects a whitelisted process
#   running.  Both process name and the user running it will be logged.
log_whitelist = no


# Name: require_init_wlist
# Type: BOOL
#
#   This option is very important for the security of your system.  When
#   this option is set to "yes", all processes running as root, and
#   controlled by init(1) will have to be whitelisted.  If this option is not
#   enabled, attackers can circumvent ninja by forking a new process after
#   gaining root, and create a new session (e.g using setsid()).  This will
#   cause ninja to believe that root spawned this process, as init(1) will now
#   be the parent, and init(1) is owned by root.  Therefore, to gain a higher
#   level of security, you should enable this option, and explicitly whitelist
#   every process that will run in its own session, meaning that it will be
#   controlled by init(1).
require_init_wlist = no


# Name: proc_scan_offset
# Type: INTEGER
#
#   This option specifies the offset of which pids to scan.  If set to 0, all
#   processes on the system will be scanned.  This might not be necessary, as
#   processes with a pid lower than 300 is generally kernel processes, and we
#   really don't need to keep an eye on those.  So, if you want to save a few
#   cpu cycles, set this to 300 or so.
proc_scan_offset = 0
