Package: chkrootkit
Version: 0.48-8
Followup-For: Bug #549938
About the -e option, the man page for chkrootkit says:
-e Exclude known false positive files/dirs, quoted, space separated.
But, when using space separated filenames in the -e option:
$ cat /etc/chkrootkit.conf
RUN_DAILY="true"
RUN_DAILY_OPTS="-q -e '/lib/init/rw/.ramfs -e /lib/init/rw/.mdadm'"
DIFF_MODE="false"
the cronjob crashes:
# /etc/cron.daily/chkrootkit
/usr/sbin/chkrootkit: `/lib/init/rw/.mdadm'': not a known test
Likewise, when using a quoted single filename in the -e option,
(eg: RUN_DAILY_OPTS="-q -e '/lib/init/rw/.ramfs'"), the chkrootkit
command run by the cron job doesn't whitelist the file (as he's looking
for quotes in the filename).
However, using a -e option for each filename (without quote), the
cronjob proceeds as expected (thanks to #489334):
$ cat /etc/chkrootkit.conf
RUN_DAILY="true"
RUN_DAILY_OPTS="-q -e /lib/init/rw/.ramfs -e /lib/init/rw/.mdadm"
DIFF_MODE="false"
To have chkrootkit behave as described in the man page, we could change
the way the daily cronjob executes chkrootkit, and use 'eval':
--- /etc/cron.daily/chkrootkit.orig 2009-12-18 11:47:34.000000000 +0100
+++ /etc/cron.daily/chkrootkit 2009-12-18 11:47:40.000000000 +0100
@@ -14,13 +14,13 @@
if [ "$RUN_DAILY" = "true" ]; then
if [ "$DIFF_MODE" = "true" ]; then
- $CHKROOTKIT $RUN_DAILY_OPTS > $LOG_DIR/log.new 2>&1
+ eval $CHKROOTKIT $RUN_DAILY_OPTS > $LOG_DIR/log.new 2>&1
if [ ! -f $LOG_DIR/log.old ] \
|| ! diff -q $LOG_DIR/log.old $LOG_DIR/log.new > /dev/null 2>&1;
then
cat $LOG_DIR/log.new
fi
mv $LOG_DIR/log.new $LOG_DIR/log.old
else
- $CHKROOTKIT $RUN_DAILY_OPTS
+ eval $CHKROOTKIT $RUN_DAILY_OPTS
fi
fi
Using this patch, everything's fine when following the behaviour
described in the man page. I may be wrong, but AFAICT, this change
doesn't have any side effect.
Best regards,
Xavier.
-- System Information:
Debian Release: 5.0.3
APT prefers stable
APT policy: (500, 'stable')
Architecture: i386 (i686)
Kernel: Linux 2.6.26-2-686-bigmem (SMP w/4 CPU cores)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages chkrootkit depends on:
ii binutils 2.18.1~cvs20080103-7 The GNU assembler, linker and bina
ii debconf [debconf-2. 1.5.24 Debian configuration management sy
ii libc6 2.7-18 GNU C Library: Shared libraries
ii net-tools 1.60-22 The NET-3 networking toolkit
ii procps 1:3.2.7-11 /proc file system utilities
chkrootkit recommends no packages.
chkrootkit suggests no packages.
-- debconf information:
* chkrootkit/run_daily_opts: -q -e '/lib/init/rw/.ramfs /lib/init/rw/.mdadm'
* chkrootkit/run_daily: true
* chkrootkit/diff_mode: false
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
