MediumCompromise indicatorsBLWK-FIM-007

Could not verify file integrity: ‹path›

What this means

‹path› exists and is on the watch list, but Bulwark could not compute its hash this scan (sha256sum unavailable, or the file could not be read), so it cannot say whether the file matches its baseline. This is reported as its own state rather than being folded into “modified” — treating “I couldn't look” as “it changed” would raise a false critical alarm, and treating it as “unchanged” would hide a real one. Neither is honest.

How to fix it

Check that the file is readable by the scanning user and that sha256sum is installed and on PATH. If a privileged scan is needed to read it, run sudo bulwark scan --privileged.

Check it yourself

Run a scan and look for BLWK-FIM-007 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads file_integrity and reports this check when:

unreadable == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

Related checks

• Shell history recording is suppressed · BLWK-EVASION-001
• File modified since baseline: ‹path› · BLWK-FIM-001
• File deleted since baseline: ‹path› · BLWK-FIM-002
• Not covered by the file-integrity baseline: ‹path› · BLWK-FIM-003
• Credential file modified since baseline: ‹path› · BLWK-FIM-004
• Credential file deleted since baseline: ‹path› · BLWK-FIM-005