How do I restore a file from quarantine?

Quarantine is a transaction, not a delete. Every step is ordered so that a crash between any two of them leaves recoverable state rather than a missing customer file. There is no chmod 000 action either: breaking a file in place is not containment, it is a support ticket.

List and restore

shelltrap quarantine list
shelltrap quarantine restore <id>

In the CyberPanel plugin, administrators can restore anything and resellers and customers can restore inside their own scope. Purge is available to administrators only.

What comes back

The restore is complete: owner, mode, times, ACLs, extended attributes and the SELinux context are all put back. Original setuid and setgid modes are restored too — that is why the service unit sets RestrictSUIDSGID=no as a narrow, deliberate exception.

Restore never overwrites an existing file at the target path. If something is already there, the restore refuses rather than destroying it. Move or rename the file in the way first, then restore.

Quarantine and different filesystems

Quarantine and the original often live on different filesystems. EXDEV is the normal case here, not an error — the transaction handles it.

How long quarantined content is kept

30 days by default, with advance warning before removal, and configurable through the quarantine.retention_days policy key. Findings are kept for 180 days and the audit log for a year. A purge is never silent.

shelltrap policy set global quarantine.retention_days=60

Removing the package does not delete quarantine

A normal removal keeps configuration, state, logs and quarantine. Even a purge only removes quarantined content behind an explicit environment gate that a human has to type:

sudo SHELLTRAP_PURGE_QUARANTINE=1 apt-get purge shelltrap

Quarantine is evidence. If you are cleaning up after an incident, keep it until the incident is closed.

If the file was fine all along

Restore it, then do two things: report the false positive to us so the rule is corrected in the next signed signature generation for everyone, and — if you need immediate quiet on that host — add an ignore rule. An ignore rule suppresses the action, never the scan or the record of the finding.