# xway_ir 默认 SUID 白名单
# 来源:NOP Team 应急响应手册 v2.0.2 + Ubuntu/CentOS/Rocky 默认清单
# 用法:find / -perm /4000 的结果与此文件比对,不在白名单中的为可疑
# 备注:不同发行版略有差异,此处取交集

/bin/mount
/bin/ping
/bin/ping6
/bin/su
/bin/umount
/bin/fusermount
/bin/fusermount3
/sbin/mount.nfs
/sbin/mount.nfs4
/sbin/umount.nfs
/sbin/umount.nfs4
/sbin/pam_timestamp_check
/sbin/unix_chkpwd
/usr/bin/at
/usr/bin/chage
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/crontab
/usr/bin/expiry
/usr/bin/fusermount
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/pkexec
/usr/bin/ssh-agent
/usr/bin/sudo
/usr/bin/mtr
/usr/bin/traceroute
/usr/bin/traceroute6
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/libexec/dbus-1/dbus-daemon-launch-helper
/usr/libexec/openssh/ssh-keysign
/usr/libexec/polkit-1/polkit-agent-helper-1
/usr/libexec/pt_chown
/usr/sbin/mount.nfs
/usr/sbin/mount.nfs4
/usr/sbin/pam_timestamp_check
/usr/sbin/pppd
/usr/sbin/unix_chkpwd
/usr/sbin/userhelper
/usr/sbin/usernetctl