Bug 1284403 - Logger is not being used correctly in /usr/bin/rkhunter
Summary: Logger is not being used correctly in /usr/bin/rkhunter
Status: CLOSED ERRATA
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: rkhunter
Version: el6
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Kevin Fenzi
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-11-23 09:19 UTC by Kees de Jong
Modified: 2017-07-20 15:19 UTC (History)
4 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2017-07-07 23:07:21 UTC


Attachments (Terms of Use)

Description Kees de Jong 2015-11-23 09:19:11 UTC
Description of problem:
In /usr/bin/rkhunter on line 17419 the following is done.

17418   if [ -n "${USE_SYSLOG}" ]; then
17419     ${LOGGER_CMD} -t "${PROGRAM_NAME}" -p ${USE_SYSLOG} "Rootkit hunter check started (version ${PROGRAM_version})"
17420   fi

Where PROGRAM_NAME="Rootkit Hunter", this is not correct usage of logger. It should not contain a space in the program name.

For example: $ logger -t "test host" -p local3.info testmessage 
Will be registered in syslog as:
1447255748 2015 Nov 11 16:29:08 test local3 info host testmessage

The program name "test host" is just "test" and "host" is being used in the syslog info message. This is a nightmare for syslog parsers.

A fix for this would be to change line 18330 to: PROGRAM_NAME="Rootkit_Hunter" or PROGRAM_NAME="rkhunter"

Comment 1 Kevin Fenzi 2015-11-25 04:37:14 UTC
Seems reasonable to change it to rkhunter, but it seems like something to discuss with upstream. 

Would you be willing to post upstream about this? or would you like me to do so?

Comment 2 Kees de Jong 2015-11-25 07:59:28 UTC
(In reply to Kevin Fenzi from comment #1)
> Seems reasonable to change it to rkhunter, but it seems like something to
> discuss with upstream. 
> 
> Would you be willing to post upstream about this? or would you like me to do
> so?

Done!
https://sourceforge.net/p/rkhunter/bugs/142/

Comment 3 John Horne 2015-11-25 10:28:02 UTC
The (F22) man page for logger mentions no such restriction on the tag.
Using Fedora 22:

   logger -t "rootkit hunter" something jh

And in the messages file I get:

   Nov 25 10:22:11 jhorne journal: rootkit hunter: something jh

And using:

   logger -t "test host" -p local3.info testmessage

I get:

   Nov 25 10:25:02 jhorne journal: test host: testmessage

So no problem with a space in the tag.

Could this be specific to Fedora 23?

Comment 4 Kees de Jong 2015-11-25 10:50:52 UTC
Sorry, I assigned it to the wrong release, it's in EPEL EL6, I updated the bug details. Maybe it is an EPEL issue, since rkhunter (logger) seems to work fine with journalctl with a space in the program name. I'll leave it up to you guys, I would suggest to change the program name in the package to rkhunter since that's more compatible with the logging software stack (syslog + logger) in EL6.

Comment 5 John Horne 2015-11-25 17:36:17 UTC
Again, tested on CentOS 6 and RHEL 7 with no problems. The tag can contain a space, provided quotes are used around the tag.

Comment 6 John Horne 2015-11-26 22:42:54 UTC
I have modified the upstream rkhunter code so that the logger tag is now 'rkhunter'.

Comment 7 Kevin Fenzi 2015-11-27 16:42:24 UTC
I'd prefer to wait for an upstream release to make this change... unless there's some pressing need?

Comment 8 Fedora Update System 2017-06-30 21:49:05 UTC
rkhunter-1.4.4-1.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-997a5a3ba1

Comment 9 Fedora Update System 2017-06-30 22:15:34 UTC
rkhunter-1.4.4-1.el6 has been submitted as an update to Fedora EPEL 6. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-383f2fab91

Comment 10 Fedora Update System 2017-06-30 22:15:44 UTC
rkhunter-1.4.4-1.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-0ba0d21577

Comment 11 Fedora Update System 2017-07-01 20:54:57 UTC
rkhunter-1.4.4-1.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-997a5a3ba1

Comment 12 Fedora Update System 2017-07-02 02:47:30 UTC
rkhunter-1.4.4-1.el7 has been pushed to the Fedora EPEL 7 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-0ba0d21577

Comment 13 Fedora Update System 2017-07-02 03:23:32 UTC
rkhunter-1.4.4-1.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-5b1d389235

Comment 14 Fedora Update System 2017-07-02 03:53:32 UTC
rkhunter-1.4.4-1.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-f5e8476376

Comment 15 Fedora Update System 2017-07-02 11:16:41 UTC
rkhunter-1.4.4-1.el6 has been pushed to the Fedora EPEL 6 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-383f2fab91

Comment 16 Fedora Update System 2017-07-03 22:44:38 UTC
rkhunter-1.4.4-2.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-1150c5994f

Comment 17 Fedora Update System 2017-07-06 02:49:52 UTC
rkhunter-1.4.4-2.el7 has been pushed to the Fedora EPEL 7 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2017-1150c5994f

Comment 18 Fedora Update System 2017-07-07 23:07:21 UTC
rkhunter-1.4.4-1.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.

Comment 19 Fedora Update System 2017-07-12 01:51:09 UTC
rkhunter-1.4.4-1.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 20 Fedora Update System 2017-07-12 03:22:47 UTC
rkhunter-1.4.4-1.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 21 Fedora Update System 2017-07-19 05:18:53 UTC
rkhunter-1.4.4-1.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.

Comment 22 Fedora Update System 2017-07-20 15:19:30 UTC
rkhunter-1.4.4-2.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.