package rkhunter
tags 443943 - moreinfo unreproducible
tags 443943 + pending
thanks
Le dimanche 07 octobre 2007 à 11:37 +0200, Julien Valroff a écrit :
> package rkhunter
> tags 443943 = moreinfo unreproducible
> thanks
>
> Hi,
>
> I can't reproduce this on several systems.
Ok, I guess I have understood: this does only happen if a suspicious
file was found in one of the SUSPSCAN_DIRS
In this case, rkhunter leaves a file in /dev/shm (the script tries to
remove it before running the test, simply moving the call to rm after
the test should fix the issue).
You can try the following patch which works ok on my system. You need to
make sure you a suspicious file in /tmp or /var/tmp before running the
test ;-)
diff -urNad /usr/bin/rkhunter.orig /usr/bin/rkhunter
--- /usr/bin/rkhunter.orig 2007-10-07 18:22:00.000000000 +0200
+++ /usr/bin/rkhunter 2007-10-07 18:22:15.000000000 +0200
@@ -5965,8 +5965,6 @@
FOUNDDIRS=""
FILENAME="${SUSPSCAN_TEMP}/suspscan.$$.strings"
- rm -f ${SUSPSCAN_TEMP}/suspscan.$$.strings >/dev/null 2>&1
-
for DIR in ${SUSPSCAN_DIRS}; do
SUSPSCAN_DIR="${RKHROOTDIR}${DIR}"
@@ -6155,6 +6153,8 @@
display --to SCREEN+LOG --type PLAIN --result WARNING --color
RED --screen-indent 4 SUSPSCAN_CHECK
fi
+ rm -f ${SUSPSCAN_TEMP}/suspscan.$$.strings >/dev/null 2>&1
+
return
}
Cheers,
Julien
