Bug 1243650

Summary: If we execute the file command against /var/log/messages then we see "/var/log/messages: ASCII Pascal program text" ?
Product: Red Hat Enterprise Linux 6 Reporter: Madhup Srivastawa <msrivast>
Component: fileAssignee: Jan Kaluža <jkaluza>
Status: CLOSED ERRATA QA Contact: Marek Marusic <mmarusic>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.5CC: akarande, mmarusic, szidek
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: file-5.04-22.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1278768 (view as bug list) Environment:
Last Closed: 2016-05-10 19:47:57 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1172231, 1254457, 1269913    

Description Madhup Srivastawa 2015-07-16 02:59:24 UTC 
Description of problem:
For some servers, when we execute the file command against /var/log/messages , we get the below results :-

[root@server ~]# file /var/log/messages
/var/log/messages: ASCII Pascal program text


Version-Release number of selected component (if applicable):

On RHEL6
file-5.04-21.el6.x86_64

On RHEL7
file-5.11-21.el7.x86_64

On 

How reproducible:
Always/Consistently

Steps to Reproduce:
Actually, the issue is observed if we have PASCAL related words in /var/log/messages however, I have demonstrated below for a general testfile and the test results hold good for /var/log/messages in RHEL6 and RHEL7. RHEL5 does not seem to be affected.

[root@RHEL6-server ~]# echo hello from localhost > testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
[root@RHEL6-server ~]# file testfile
testfile: ASCII text
[root@RHEL6-server ~]# echo record >> testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
record
[root@RHEL6-server ~]# file testfile
testfile: ASCII Pascal program text  ==> Issue reproduced

[root@RHEL7-server ~]# echo hello from localhost > testfile
[root@RHEL7-server ~]# cat testfile
hello from localhost
[root@RHEL7-server ~]# file testfile
testfile: ASCII text
[root@RHEL7-server ~]# echo record >> testfile
[root@RHEL7-server ~]# cat testfile 
hello from localhost
record
[root@RHEL7-server ~]# file testfile 
testfile: Pascal source, ASCII text  ==> Issue reproduced


Actual results:
After the record word insertion (which is a PASCAL related word) , we see this :-
[root@RHEL6-server ~]# echo record >> testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
record
[root@RHEL6-server ~]# file testfile
testfile: ASCII Pascal program text

[root@RHEL7-server ~]# echo record >> testfile
[root@RHEL7-server ~]# cat testfile 
hello from localhost
record
[root@RHEL7-server ~]# file testfile 
testfile: Pascal source, ASCII text


Expected results:

[root@RHEL6-server ~]# echo record >> testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
record
[root@RHEL6-server ~]# file testfile
testfile: ASCII text

[root@RHEL7-server ~]# echo record >> testfile
[root@RHEL7-server ~]# cat testfile 
hello from localhost
record
[root@RHEL7-server ~]# file testfile 
testfile: ASCII text



Additional info: Just an insignificant note, I observed this for the packages I am on currently, some older or newer packages might be affected too.
Comment 2 Jan Kaluža 2015-07-16 09:38:14 UTC 
This is caused by File magic entry for Pascal:

0	regex		\^program	Pascal source text
!:mime	text/x-pascal
0	regex           	\^record		Pascal source text
!:mime	text/x-pascal

If line is file is starting with "program" and "record", the file is identified as Pascal source.

Upstream has removed these weak patterns recently, we could do the same in RHEL6.
Comment 9 errata-xmlrpc 2016-05-10 19:47:57 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-0760.html