Bug 1278768 - If we execute the file command against /var/log/messages then we see "/var/log/messages: ASCII Pascal program text" ?
Summary: If we execute the file command against /var/log/messages then we see "/var/lo...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: file
Version: 7.2
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Kamil Dudka
QA Contact: Karel Srot
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-11-06 11:33 UTC by Marek Marusic
Modified: 2016-11-04 07:36 UTC (History)
1 user (show)

Fixed In Version: file-5.11-32.el7
Doc Type: Bug Fix
Doc Text:
Needless to document.
Clone Of: 1243650
Environment:
Last Closed: 2016-11-04 07:36:50 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2491 normal SHIPPED_LIVE file bug fix and enhancement update 2016-11-03 14:10:49 UTC

Description Marek Marusic 2015-11-06 11:33:15 UTC
This bug is also present on RHEL7

Version-Release number of selected component (if applicable):
file-5.11-31.el7.x86_64

+++ This bug was initially created as a clone of Bug #1243650 +++

Description of problem:
For some servers, when we execute the file command against /var/log/messages , we get the below results :-

[root@server ~]# file /var/log/messages
/var/log/messages: ASCII Pascal program text


Version-Release number of selected component (if applicable):

On RHEL6
file-5.04-21.el6.x86_64

On RHEL7
file-5.11-21.el7.x86_64

On 

How reproducible:
Always/Consistently

Steps to Reproduce:
Actually, the issue is observed if we have PASCAL related words in /var/log/messages however, I have demonstrated below for a general testfile and the test results hold good for /var/log/messages in RHEL6 and RHEL7. RHEL5 does not seem to be affected.

[root@RHEL6-server ~]# echo hello from localhost > testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
[root@RHEL6-server ~]# file testfile
testfile: ASCII text
[root@RHEL6-server ~]# echo record >> testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
record
[root@RHEL6-server ~]# file testfile
testfile: ASCII Pascal program text  ==> Issue reproduced

[root@RHEL7-server ~]# echo hello from localhost > testfile
[root@RHEL7-server ~]# cat testfile
hello from localhost
[root@RHEL7-server ~]# file testfile
testfile: ASCII text
[root@RHEL7-server ~]# echo record >> testfile
[root@RHEL7-server ~]# cat testfile 
hello from localhost
record
[root@RHEL7-server ~]# file testfile 
testfile: Pascal source, ASCII text  ==> Issue reproduced


Actual results:
After the record word insertion (which is a PASCAL related word) , we see this :-
[root@RHEL6-server ~]# echo record >> testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
record
[root@RHEL6-server ~]# file testfile
testfile: ASCII Pascal program text

[root@RHEL7-server ~]# echo record >> testfile
[root@RHEL7-server ~]# cat testfile 
hello from localhost
record
[root@RHEL7-server ~]# file testfile 
testfile: Pascal source, ASCII text


Expected results:

[root@RHEL6-server ~]# echo record >> testfile
[root@RHEL6-server ~]# cat testfile 
hello from localhost
record
[root@RHEL6-server ~]# file testfile
testfile: ASCII text

[root@RHEL7-server ~]# echo record >> testfile
[root@RHEL7-server ~]# cat testfile 
hello from localhost
record
[root@RHEL7-server ~]# file testfile 
testfile: ASCII text


--- Additional comment from Jan Kaluža on 2015-07-16 05:38:14 EDT ---

This is caused by File magic entry for Pascal:

0	regex		\^program	Pascal source text
!:mime	text/x-pascal
0	regex           	\^record		Pascal source text
!:mime	text/x-pascal

If line is file is starting with "program" and "record", the file is identified as Pascal source.

Upstream has removed these weak patterns recently, we could do the same in RHEL6.

Comment 8 errata-xmlrpc 2016-11-04 07:36:50 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2491.html


Note You need to log in before you can comment on or make changes to this bug.