InfoCompromise indicatorsBLWK-FIM-009

No file-integrity baseline recorded yet

What this means

Bulwark watches ‹watched› critical files (sshd_config, PAM, sudo, su, login settings and similar) for tampering, but no known-good baseline has been recorded on this machine, so it can see the files exist but not whether any of them has been changed.

How to fix it

Run bulwark fim baseline now, while you trust this machine, to record known-good hashes (add --privileged with sudo to also cover /etc/shadow and /etc/sudoers). In the desktop app: File changes → Record baseline.

Check it yourself

Run a scan and look for BLWK-FIM-009 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads file_integrity and reports this check when:

kind == "summary" and baseline_exists == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

Related checks

• Shell history recording is suppressed · BLWK-EVASION-001
• File modified since baseline: ‹path› · BLWK-FIM-001
• File deleted since baseline: ‹path› · BLWK-FIM-002
• Not covered by the file-integrity baseline: ‹path› · BLWK-FIM-003
• Credential file modified since baseline: ‹path› · BLWK-FIM-004
• Credential file deleted since baseline: ‹path› · BLWK-FIM-005