| Summary: | strange warning about replaced /usr/bin/rkhunter | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Thomas Moschny <thomas.moschny> |
| Component: | rkhunter | Assignee: | Kevin Fenzi <kevin> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 15 | CC: | kevin |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | rkhunter-1.3.8-8.fc15 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-07-22 19:25:42 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Thomas Moschny
2011-07-06 09:51:04 UTC
There was a report of this on an upstream list, but unfortunately without much detail. When did you start seeing these messages? Can you see any updates around that time (check /var/log/yum.log) that might be related? In particular the 'file' command. You have run a 'rkhunter --propupd' right? (In reply to comment #1) > There was a report of this on an upstream list, but unfortunately without much > detail. > > When did you start seeing these messages? > Can you see any updates around that time (check /var/log/yum.log) that might be > related? > In particular the 'file' command. I think I saw this message from the very beginning (installed rkhunter just a couple of days ago). > You have run a 'rkhunter --propupd' right? No, I did not. Running it now seems to suppress that warning. Imho that doesn't make this ticket useless though. The rkhunter RPM seems to come with wrong information (or wrong implicit assumptions) about the /usr/bin/rkhunter file. While in general it is true that only the admin knows the state of the machine and propupd should not be run automatically, the rkhunter RPM should at least know its own files. Looking at the code, there seems to be some special case handling for the rkhunter script itself, in /usr/bin/rkhunter:10068, needing to be fixed. # with file.x86_64 0:5.05-3.fc15: $ file /usr/bin/rkhunter /usr/bin/rkhunter: POSIX shell script text executable # with file.x86_64 0:5.07-4.fc15: $ file /usr/bin/rkhunter /usr/bin/rkhunter: POSIX shell script, ASCII text executable, with very long lines rkhunter-1.3.8-7.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/rkhunter-1.3.8-7.fc15 rkhunter-1.3.8-8.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/rkhunter-1.3.8-8.fc15 rkhunter-1.3.8-8.fc15 has been submitted as an update for Fedora 15. https://admin.fedoraproject.org/updates/rkhunter-1.3.8-8.fc15 Package rkhunter-1.3.8-8.fc15: * should fix your issue, * was pushed to the Fedora 15 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing rkhunter-1.3.8-8.fc15' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/rkhunter-1.3.8-8.fc15 then log in and leave karma (feedback). rkhunter-1.3.8-8.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report. |