Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1243650 - If we execute the file command against /var/log/messages then we see "/var/log/messages: ASCII Pascal program text" ?
If we execute the file command against /var/log/messages then we see "/var/lo...
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: file (Show other bugs)
6.5
All Linux
medium Severity medium
: rc
: ---
Assigned To: Jan Kaluža
Marek Marusic
:
Depends On:
Blocks: 1172231 1254457 1269913
  Show dependency treegraph
 
Reported: 2015-07-15 22:59 EDT by Madhup Srivastawa
Modified: 2016-05-10 15:47 EDT (History)
3 users (show)

See Also:
Fixed In Version: file-5.04-22.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1278768 (view as bug list)
Environment:
Last Closed: 2016-05-10 15:47:57 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:0760 normal SHIPPED_LIVE Moderate: file security, bug fix, and enhancement update 2016-05-10 18:32:51 EDT

  None (edit)
Description Madhup Srivastawa 2015-07-15 22:59:24 EDT
Description of problem:
For some servers, when we execute the file command against /var/log/messages , we get the below results :-

[root@server ~]# file /var/log/messages
/var/log/messages: ASCII Pascal program text


Version-Release number of selected component (if applicable):

On RHEL6
file-5.04-21.el6.x86_64

On RHEL7
file-5.11-21.el7.x86_64

On 

How reproducible:
Always/Consistently

Steps to Reproduce:
Actually, the issue is observed if we have PASCAL related words in /var/log/messages however, I have demonstrated below for a general testfile and the test results hold good for /var/log/messages in RHEL6 and RHEL7. RHEL5 does not seem to be affected.

[root@RHEL6-server ~]# echo hello from localhost > testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
[root@RHEL6-server ~]# file testfile
testfile: ASCII text
[root@RHEL6-server ~]# echo record >> testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
record
[root@RHEL6-server ~]# file testfile
testfile: ASCII Pascal program text  ==> Issue reproduced

[root@RHEL7-server ~]# echo hello from localhost > testfile
[root@RHEL7-server ~]# cat testfile
hello from localhost
[root@RHEL7-server ~]# file testfile
testfile: ASCII text
[root@RHEL7-server ~]# echo record >> testfile
[root@RHEL7-server ~]# cat testfile 
hello from localhost
record
[root@RHEL7-server ~]# file testfile 
testfile: Pascal source, ASCII text  ==> Issue reproduced


Actual results:
After the record word insertion (which is a PASCAL related word) , we see this :-
[root@RHEL6-server ~]# echo record >> testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
record
[root@RHEL6-server ~]# file testfile
testfile: ASCII Pascal program text

[root@RHEL7-server ~]# echo record >> testfile
[root@RHEL7-server ~]# cat testfile 
hello from localhost
record
[root@RHEL7-server ~]# file testfile 
testfile: Pascal source, ASCII text


Expected results:

[root@RHEL6-server ~]# echo record >> testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
record
[root@RHEL6-server ~]# file testfile
testfile: ASCII text

[root@RHEL7-server ~]# echo record >> testfile
[root@RHEL7-server ~]# cat testfile 
hello from localhost
record
[root@RHEL7-server ~]# file testfile 
testfile: ASCII text



Additional info: Just an insignificant note, I observed this for the packages I am on currently, some older or newer packages might be affected too.
Comment 2 Jan Kaluža 2015-07-16 05:38:14 EDT
This is caused by File magic entry for Pascal:

0	regex		\^program	Pascal source text
!:mime	text/x-pascal
0	regex           	\^record		Pascal source text
!:mime	text/x-pascal

If line is file is starting with "program" and "record", the file is identified as Pascal source.

Upstream has removed these weak patterns recently, we could do the same in RHEL6.
Comment 9 errata-xmlrpc 2016-05-10 15:47:57 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2016-0760.html

Note You need to log in before you can comment on or make changes to this bug.