Configuration

owLSM has a single config file which controls every aspect of its behavior.
See How to generate a config in the repo.

Full Configuration Structure

{
    "features": {
        "file_monitoring": {
            "enabled": true,
            "events": {
                "chmod": true,
                "chown": true,
                "file_create": true,
                "unlink": true,
                "rename": true,
                "write": true,
                "read": true,  # Due to high volume of read syscalls, we advise to disable.
                "mkdir": true,
                "rmdir": true
            }
        },C
        "network_monitoring": {
            "enabled": true
        }
    },
    "userspace": {
        "max_events_queue_size": 10000,
        "output_type": "JSON",
        "log_level": "LOG_LEVEL_INFO",
        "set_limits": true
    },
    "kernel": {
        "log_level": "LOG_LEVEL_WARNING"
    },
    "rules": [ ... ]
}

---

Configuration Reference

features

Required: false

Default value: All monitoring features are enabled by default

Control what security features are enabled.
The following features are always enabled: exec monitoring, fork monitoring, and process exit monitoring.

features.file_monitoring

Required: false

Default value: All filesystem monitoring features are enabled by default

Controls file system monitoring. When enabled, owLSM hooks into file operations and can detect/prevent malicious file access.

features.file_monitoring.enabled

Required: false

Default value: true

Options: true, false

Master switch for file system monitoring.

features.file_monitoring.events.chmod

Required: false

Default value: true

Options: true, false

Monitor chmod syscall

features.file_monitoring.events.chown

Required: false

Default value: true

Options: true, false

Monitor chown syscall

features.file_monitoring.events.file_create

Required: false

Default value: true

Options: true, false

Monitor regular file creation

features.file_monitoring.events.unlink

Required: false

Default value: true

Options: true, false

Monitor unlink syscall (file deletion)

features.file_monitoring.events.mkdir

Required: false

Default value: true

Options: true, false

Monitor mkdir syscall (directory creation)

features.file_monitoring.events.rmdir

Required: false

Default value: true

Options: true, false

Monitor rmdir syscall (directory deletion)

features.file_monitoring.events.rename

Required: false

Default value: true

Options: true, false

Monitor rename syscall

features.file_monitoring.events.write

Required: false

Default value: true

Options: true, false

Monitor write syscall. Only for regular files and symlinks.

features.file_monitoring.events.read

Required: false

Default value: true

Options: true, false

Monitor read syscall. Only for regular files and symlinks.
Due to high volume of read syscalls, we strongly advise to disable this feature.

features.network_monitoring

Required: false

Default value: network monitoring is enabled

Controls network connection monitoring.
Currently, only TCP connections are supported.

features.network_monitoring.enabled

Required: false

Default value: true

Options: true, false

Enable network connection monitoring.
Currently, only TCP connections are supported.

---

userspace

Required: false

The `userspace` section configures the userspace component of owLSM.

userspace.max_events_queue_size

Required: false

Default value: 10000

Options: Integer (1000 - 1000000)

Maximum events in the processing queue.
Controls the size of the event buffer. Larger values handle burst traffic better but use more memory.

userspace.output_type

Required: false

Default value: "JSON"

Options: "JSON"

Output format for events.
"PROTOBUF" will be supported in the future.

userspace.log_level

Required: false

Default value: "LOG_LEVEL_INFO"

Options: "LOG_LEVEL_DEBUG", "LOG_LEVEL_INFO", "LOG_LEVEL_WARNING", "LOG_LEVEL_ERROR"

Logging verbosity for userspace.

userspace.set_limits

Required: false

Default value: true

Options: true, false

Set climits. Should be enabled.

---

kernel

Required: false

Default value: { log_level: "LOG_LEVEL_WARNING" }

Options: Object containing kernel configuration

The `kernel` section configures the kernel component of owLSM.

kernel.log_level

Required: false

Default value: "LOG_LEVEL_WARNING"

Options: "LOG_LEVEL_DEBUG", "LOG_LEVEL_INFO", "LOG_LEVEL_WARNING", "LOG_LEVEL_ERROR"

Kernel-side logging verbosity. Keep at `LOG_LEVEL_WARNING` or higher in production for performance.

---

rules

Required: false

Default value: No rules

The `rules` array.
See How to generate a config with rules in the repo.