HighCompromise indicatorsBLWK-FIM-008

Could not verify credential file: ‹path›

What this means

‹path› (/etc/shadow or /etc/sudoers) exists but its hash could not be computed this scan, so its integrity is unverifiable. Rated high because on the two most sensitive files Bulwark tracks, an inability to read them is itself worth attention — it can mean a permissions change that a privileged scan should have handled, or something actively interfering with access. It is deliberately not reported as “modified”: a failure to look is not evidence of a change.

How to fix it

Re-run under privilege (sudo bulwark scan --privileged) so the file is readable, and confirm sha256sum is installed. If it still can't be read as root, investigate why.

Check it yourself

Run a scan and look for BLWK-FIM-008 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads file_integrity_privileged and reports this check when:

unreadable == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

Related checks

• Shell history recording is suppressed · BLWK-EVASION-001
• File modified since baseline: ‹path› · BLWK-FIM-001
• File deleted since baseline: ‹path› · BLWK-FIM-002
• Not covered by the file-integrity baseline: ‹path› · BLWK-FIM-003
• Credential file modified since baseline: ‹path› · BLWK-FIM-004
• Credential file deleted since baseline: ‹path› · BLWK-FIM-005