Linux Platforms
Overview
Siberson Veriket Data Classification brings data security directly into the tools end users work with every day on Linux. Classification, labeling, and encryption are accessible from the file manager right-click menu, the desktop system tray, and an automatic file watcher that detects new and changed documents in real time — without requiring the user to open a separate console or leave their workflow.
This guide walks through the end-user experience on Linux, from locating the classification controls to completing a full classification and sensitivity declaration.
| Who should read this Any employee on Linux who creates, edits, or shares documents containing internal, confidential, or regulated information (personal data, financial records, intellectual property). |
|---|
Access Points
Siberson Veriket Data Classification surfaces its controls in three complementary locations on Linux, so the user can classify data at the most natural point of interaction.
1. File Manager — Right-Click → Scripts → Classify
Right-clicking any document in the file manager (Nautilus / Files, Nemo, Caja, or any GTK-compatible file manager) exposes a Scripts submenu containing the Classify action. Selecting it opens the Veriket classification dialog for the chosen file.
Veriket integrates with the desktop environment using the standard Nautilus Scripts mechanism — no kernel modules, no shell extensions, no root privileges required for the user-facing flow. The script is installed to the user’s scripts directory during agent setup and is immediately discoverable by every supported file manager on the system.
| Figure: Right-click context menu in the file manager → Scripts → Classify. |
|---|
2. System Tray
The Veriket agent runs as a background service and surfaces its state through the desktop environment’s application area / system tray. The presence of the Veriket V icon among the running applications confirms that the classification service is active on the endpoint and ready to handle classification, file-watcher, and metadata write events.
| Figure: Veriket V application icon — visible whenever the classification service is running. |
|---|
3. File Watcher
In addition to user-initiated classification through the right-click menu, Veriket runs a background file watcher that monitors document activity across the user’s working directories. The watcher keeps classification coverage continuous — even when documents are produced or modified by applications that bypass the file manager (for example, files generated by a build pipeline, downloaded by a browser, or written by a synced cloud client).
The watcher uses the kernel’s inotify subsystem to react to filesystem events without polling, and reacts to three event classes:
-
Document created — a previously unseen document appears under a watched path. Veriket scans the content, runs detection policies, and either auto-classifies the file (according to organization policy) or prompts the user to classify it through the same dialog used by the right-click flow.
-
Document modified — the content of a classified document changes. Veriket re-runs detection to confirm that the existing classification is still appropriate; if the new content matches a higher-sensitivity policy, the user is asked to upgrade the label.
-
Document deleted — a classified document is removed. Veriket records the event in the local audit log so that downstream tools — including Verikor DLP — can correlate the deletion against the file’s last-known classification metadata.
The file watcher ensures that no document escapes classification simply because it was created outside the right-click flow.
The Classification Workflow
When a user initiates classification — from the right-click menu, the file watcher prompt, or a command-line invocation — the unified Veriket Classification dialog opens. Unlike the multi-tab form on macOS, the Linux client presents every section in a single window, so the user can review and complete the entire declaration without switching tabs.
| Figure: Veriket Classification dialog on Linux — single-window form with Policy, Scope, Classification, and Sensitivity sections. |
|---|
Policy Information. If Veriket’s automated engine has detected sensitive content, the matching Policy is displayed (for example, Personal Data Policy), together with the Keywords that triggered the match. Both fields are read-only and provide immediate insight into why classification is being requested.
Scope. The user defines the applicable scope of the classification — typically the organization, business unit, or sharing context the document belongs to. The scope tile is highlighted with a colored frame and a small status indicator to show the active selection at a glance.
Classification. The user picks one of the configured sensitivity tiles, each color-coded:
| Level | Color | Typical Use |
|---|---|---|
| Top Secret | Red | Data with the most restricted access inside the organization |
| Secret | Orange | Data that may be less restrictive internally, but which could cause damage if disclosed |
| Internal | Yellow | Proprietary data disclosed outside the company on a limited basis only |
| Public | Gray | Publicly available data, the least sensitive data used by the company |
Sensitivity. The same dialog also captures personal-data context, which is essential for KVKK and GDPR compliance. The user declares one of three states:
-
Special Qualified Personal Data — data related to race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, costume and dress (highest-risk category under KVKK / GDPR)
-
Contains Personal Data — any information relating to an identified or identifiable natural person
-
Not Contains Personal Data — confirms the document carries no personal data
Selecting Classify commits the entire form — Policy, Scope, Classification, and Sensitivity — and writes the metadata to the file in a single operation. There is no separate "Next" / "Previous" navigation.
Visual Indicators on Classified Files
Once a file has been classified, Siberson Veriket Data Classification applies visible cues both inside and outside the document. On Linux, classification metadata is stored using the standard POSIX extended-attribute (xattr) interface, so the labels are first-class citizens of the filesystem — readable by any xattr-aware tool and visible from the file manager’s standard properties dialog.
Extended attributes (xattr). Veriket writes the classification level, sensitivity declaration, scope, and GDPR attributes as user.veriket.* extended attributes on the file inode. These attributes can be inspected from a terminal with standard tooling, for example:
$ getfattr -d -m '^user\.veriket\.' identity-number.odt
File manager properties. The same metadata is exposed in the file manager’s Properties dialog, so users can verify a file’s classification without leaving the GUI. Look for a Classification or Veriket tab/section listing the level, sensitivity, scope, and GDPR fields.
Document watermarks. Headers, footers, and body watermarks appear inside the document according to the classification level and the watermark options selected during classification. This is independent of the desktop environment and works for ODT, DOCX, and PDF formats.
Metadata propagation. xattrs survive within the same filesystem when files are moved or copied with attribute-preserving tools (cp -p, rsync -X, tar --xattrs). When a classified document is shared outside the host — by email attachment, archive upload, or cross-platform transfer — the classification, sensitivity, and GDPR attributes are also embedded inside the document file itself, so they remain attached regardless of destination and continue to be readable by Verikor DLP and other downstream enforcement tools.
Best Practices for End Users
-
Classify at creation. — The most reliable point to classify a document is the moment it is first saved. The Scripts → Classify action and the file-watcher prompt are designed to make this a one-click habit.
-
Respect the Detected Policy suggestions. — When the Policy section surfaces a detected pattern (such as a personal identifier or financial number), treat it as a strong signal that the document contains regulated data and classify accordingly.
-
Use encryption for external sharing. — Classification and watermarks signal sensitivity, but they do not restrict access. For documents leaving the organization to untrusted recipients, combine classification with Veriket File Encryption.
-
Preserve attributes when copying. — When moving classified files between directories or hosts, use cp -p, rsync -X, or tar --xattrs so the user.veriket.* extended attributes travel with the file. Tools that strip xattrs will leave the file looking unclassified at the filesystem layer (the in-document metadata still survives).
-
Keep GDPR declarations accurate. — The consent, export, and retention fields are not informational — they become part of the compliance record for the document and may be reviewed during audits.
-
Do not downgrade without justification. — Reducing a file’s classification level (for example, from Secret to Internal) should reflect a genuine change in sensitivity, not a convenience decision. Administrators may receive alerts on unusual downgrade patterns.
Frequently Asked Questions
Do I need to classify every file I create?
Your organization defines this policy. Veriket can be configured to require classification on save, to prompt the user via the file watcher, or to apply a default classification automatically.
What happens if I ignore the classification prompt?
Depending on organizational policy, the file may be saved with a default classification, or the save operation may be blocked until classification is provided.
Will my classification travel with the file if I send it outside the organization?
Yes. Classification metadata is embedded both as POSIX extended attributes on the file and inside the document itself. The in-document copy survives regardless of destination — including when the file is opened on Windows or macOS.
Why does my file appear unclassified after I copied it to a different machine?
POSIX extended attributes are not preserved by default by every copy tool. Use cp -p, rsync -X, or tar --xattrs to keep the user.veriket.* attributes intact. The classification embedded inside the document body is unaffected and will still be visible when the file is opened.
Can I change a classification after applying it?
Yes, through the same Scripts → Classify action or by re-opening the file via the file watcher. Changes are logged for audit purposes.
Does encryption replace classification?
No. Encryption and classification serve different purposes. Classification identifies what the data is; encryption restricts who can access it. They are most effective when used together on high-risk documents.
Last updated: 2026-05-08