Bug 1243650 - If we execute the file command against /var/log/messages then we see "/var/log/messages: ASCII Pascal program text" ?
Summary: If we execute the file command against /var/log/messages then we see "/var/lo...
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: file
Version: 6.5
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Jan Kaluža
QA Contact: Marek Marusic
URL:
Whiteboard:
Keywords:
Depends On:
Blocks: 1172231 1254457 1269913
TreeView+ depends on / blocked
 
Reported: 2015-07-16 02:59 UTC by Madhup Srivastawa
Modified: 2016-05-10 19:47 UTC (History)
3 users (show)

(edit)
Clone Of:
: 1278768 (view as bug list)
(edit)
Last Closed: 2016-05-10 19:47:57 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:0760 normal SHIPPED_LIVE Moderate: file security, bug fix, and enhancement update 2016-05-10 22:32:51 UTC

Description Madhup Srivastawa 2015-07-16 02:59:24 UTC
Description of problem:
For some servers, when we execute the file command against /var/log/messages , we get the below results :-

[root@server ~]# file /var/log/messages
/var/log/messages: ASCII Pascal program text


Version-Release number of selected component (if applicable):

On RHEL6
file-5.04-21.el6.x86_64

On RHEL7
file-5.11-21.el7.x86_64

On 

How reproducible:
Always/Consistently

Steps to Reproduce:
Actually, the issue is observed if we have PASCAL related words in /var/log/messages however, I have demonstrated below for a general testfile and the test results hold good for /var/log/messages in RHEL6 and RHEL7. RHEL5 does not seem to be affected.

[root@RHEL6-server ~]# echo hello from localhost > testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
[root@RHEL6-server ~]# file testfile
testfile: ASCII text
[root@RHEL6-server ~]# echo record >> testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
record
[root@RHEL6-server ~]# file testfile
testfile: ASCII Pascal program text  ==> Issue reproduced

[root@RHEL7-server ~]# echo hello from localhost > testfile
[root@RHEL7-server ~]# cat testfile
hello from localhost
[root@RHEL7-server ~]# file testfile
testfile: ASCII text
[root@RHEL7-server ~]# echo record >> testfile
[root@RHEL7-server ~]# cat testfile 
hello from localhost
record
[root@RHEL7-server ~]# file testfile 
testfile: Pascal source, ASCII text  ==> Issue reproduced


Actual results:
After the record word insertion (which is a PASCAL related word) , we see this :-
[root@RHEL6-server ~]# echo record >> testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
record
[root@RHEL6-server ~]# file testfile
testfile: ASCII Pascal program text

[root@RHEL7-server ~]# echo record >> testfile
[root@RHEL7-server ~]# cat testfile 
hello from localhost
record
[root@RHEL7-server ~]# file testfile 
testfile: Pascal source, ASCII text


Expected results:

[root@RHEL6-server ~]# echo record >> testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
record
[root@RHEL6-server ~]# file testfile
testfile: ASCII text

[root@RHEL7-server ~]# echo record >> testfile
[root@RHEL7-server ~]# cat testfile 
hello from localhost
record
[root@RHEL7-server ~]# file testfile 
testfile: ASCII text



Additional info: Just an insignificant note, I observed this for the packages I am on currently, some older or newer packages might be affected too.

Comment 2 Jan Kaluža 2015-07-16 09:38:14 UTC
This is caused by File magic entry for Pascal:

0	regex		\^program	Pascal source text
!:mime	text/x-pascal
0	regex           	\^record		Pascal source text
!:mime	text/x-pascal

If line is file is starting with "program" and "record", the file is identified as Pascal source.

Upstream has removed these weak patterns recently, we could do the same in RHEL6.

Comment 9 errata-xmlrpc 2016-05-10 19:47:57 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-0760.html


Note You need to log in before you can comment on or make changes to this bug.