From 84af7f31fdb22cd01e7ec1ca72fb4b6fde55f648 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Fri, 20 Jun 2014 19:50:52 -0600
Subject: [PATCH 01/14] sync up with master and make initial build for epel7

---
 rkhunter-1.4.2-fedoraconfig.patch | 27 ++++++++++++++++++---------
 rkhunter-1.4.2-ipcs-locale.patch  | 18 ++++++++++++++++++
 rkhunter.spec                     | 16 ++++++++++++++--
 3 files changed, 50 insertions(+), 11 deletions(-)
 create mode 100644 rkhunter-1.4.2-ipcs-locale.patch

diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch
index d6e6f07..2117d1b 100644
--- a/rkhunter-1.4.2-fedoraconfig.patch
+++ b/rkhunter-1.4.2-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf
---- rkhunter-1.4.2.orig/files/rkhunter.conf	2014-02-23 19:38:01.000000000 -0700
-+++ rkhunter-1.4.2/files/rkhunter.conf	2014-03-05 17:23:47.171809385 -0700
+--- rkhunter-1.4.2.orig/files/rkhunter.conf	2014-01-25 14:29:51.000000000 -0700
++++ rkhunter-1.4.2/files/rkhunter.conf	2014-04-06 11:43:15.719800756 -0600
 @@ -155,6 +155,7 @@
  # default directory beneath the installation directory.
  #
@@ -77,17 +77,22 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # It is possible that a file, which is part of a package, may have been
-@@ -545,6 +552,9 @@
+@@ -545,6 +552,14 @@
  # The default value is the null string.
  #
  #EXISTWHITELIST=""
 +EXISTWHITELIST=/bin/ad
 +# FreeIPA Certificate Authority
 +EXISTWHITELIST=/var/log/pki-ca/system
++# FreeIPA Certificate Authority
++EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system
++# Some non default installed files we check
++EXISTWHITELIST=/usr/bin/GET
++EXISTWHITELIST=/usr/bin/whatis
  
  #
  # Whitelist various attributes of the specified file. The attributes are those
-@@ -575,6 +585,12 @@
+@@ -575,6 +590,12 @@
  # The default value is the null string.
  #
  #SCRIPTWHITELIST=/usr/bin/groups
@@ -100,7 +105,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Allow the specified file to have the immutable attribute set.
-@@ -605,6 +621,19 @@
+@@ -605,6 +626,19 @@
  #ALLOWHIDDENDIR=/dev/.udev
  #ALLOWHIDDENDIR=/dev/.udevdb
  #ALLOWHIDDENDIR=/dev/.mdadm
@@ -120,7 +125,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -620,6 +649,30 @@
+@@ -620,6 +654,30 @@
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
  #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
@@ -151,7 +156,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -681,6 +734,16 @@
+@@ -681,6 +739,18 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -165,20 +170,24 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
 +ALLOWDEVFILE="/dev/shm/spice.*"
 +# created by mdadm
 +ALLOWDEVFILE="/dev/md/autorebuild.pid"
++# 389 Directory Server
++ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats
  
  #
  # This option is used to indicate if the Phalanx2 test is to perform a basic
-@@ -1004,6 +1067,9 @@
+@@ -1004,6 +1074,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
 +RTKT_FILE_WHITELIST=/bin/ad
 +# FreeIPA Certificate Authority
 +RTKT_FILE_WHITELIST=/var/log/pki-ca/system
++# FreeIPA Certificate Authority
++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/ca/system
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1222,3 +1288,5 @@
+@@ -1222,3 +1297,5 @@
  #
  #EMPTY_LOGFILES=""
  #MISSING_LOGFILES=""
diff --git a/rkhunter-1.4.2-ipcs-locale.patch b/rkhunter-1.4.2-ipcs-locale.patch
new file mode 100644
index 0000000..0457e4c
--- /dev/null
+++ b/rkhunter-1.4.2-ipcs-locale.patch
@@ -0,0 +1,18 @@
+diff -Nur rkhunter-1.4.2.orig/files/rkhunter rkhunter-1.4.2/files/rkhunter
+--- rkhunter-1.4.2.orig/files/rkhunter	2014-03-12 14:54:55.000000000 -0600
++++ rkhunter-1.4.2/files/rkhunter	2014-04-06 11:39:44.776583858 -0600
+@@ -13964,11 +13964,11 @@
+                         touch "${IPCS_TMPFILE}"
+                         FOUND=0; echo $FOUND > "${IPCS_TMPFILE}"
+ 
+-                        if [ `${IPCS_CMD} -u 2>/dev/null | awk -F' ' '/segments allocated/ {print $3}'` -ne 0 ]; then
+-                                ${IPCS_CMD} -m | grep "^0x" | while read RKH_SHM_KEY RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_PERMS RKH_SHM_BYTES RKH_SHM_NATTACH RKH_SHM_STATUS; do
++                        if [ `LC_ALL=C ${IPCS_CMD} -u 2>/dev/null | awk -F' ' '/segments allocated/ {print $3}'` -ne 0 ]; then
++                                LC_ALL=C ${IPCS_CMD} -m | grep "^0x" | while read RKH_SHM_KEY RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_PERMS RKH_SHM_BYTES RKH_SHM_NATTACH RKH_SHM_STATUS; do
+                                         if [ $RKH_SHM_PERMS -eq 666 -a $RKH_SHM_BYTES -ge 1000000 ]; then
+                                                 FOUND=1; echo $FOUND > "${IPCS_TMPFILE}"
+-                                                ${IPCS_CMD} -p | grep "^${RKH_SHM_SHMID}" | while read RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_CPID RKH_SHM_LPID; do
++                                                LC_ALL=C ${IPCS_CMD} -p | grep "^${RKH_SHM_SHMID}" | while read RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_CPID RKH_SHM_LPID; do
+                                                         RKH_SHM_PATH=`${READLINK_CMD} -f /proc/${RKH_SHM_CPID}/exe`
+                                                         if [ $VERBOSE_LOGGING -eq 1 ]; then
+                                                                 display --to LOG --type PLAIN --result FOUND --log-indent 2 ROOTKIT_MALWARE_IPCS_DETAILS "${RKH_SHM_PATH}" "${RKH_SHM_CPID}" "${RKH_SHM_OWNER}"
diff --git a/rkhunter.spec b/rkhunter.spec
index f322617..b956418 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        1%{?dist}
+Release:        3%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -13,6 +13,10 @@ Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.ta
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
 Patch0:         rkhunter-1.4.2-fedoraconfig.patch
+#
+# Fix issue with ipcs command and locales
+#
+Patch1:         rkhunter-1.4.2-ipcs-locale.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -31,6 +35,7 @@ and other unwanted tools.
 %setup -q
 
 %patch0 -p1
+%patch1 -p1
 
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}/%{name}.log {
@@ -99,6 +104,13 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Sun Apr 06 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-2
+- Add patch to fix ipcs command in non en locales
+- Add config to fix freeipa installs. Fixes bug #994567
+
 * Fri Mar 14 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-1
 - Update to 1.4.2
 
@@ -289,7 +301,7 @@ EOF
 - Changed to SHA1 for optional message digest (canary check)
 - Added a couple of suggested skip entries to rkhunter.conf
 
-* Mon Jun 11 2005 Greg Houlette <tamaster@pobox.com> - 1.2.7-1
+* Sat Jun 11 2005 Greg Houlette <tamaster@pobox.com> - 1.2.7-1
 - Added signature auto-updating to CRON scan (new script)
 - Removed BOOTSCAN pending rewrite to full SysV Init scan in background
 - Added the --append-log command line option

From 45eaa90a75e5b379805b897e4e88ef3453855dbf Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Fri, 26 Sep 2014 12:16:45 -0600
Subject: [PATCH 02/14] Fix cron script to work with non bash shells. Fixes bug
 #1146717

---
 01-rkhunter   | 2 +-
 rkhunter.spec | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/01-rkhunter b/01-rkhunter
index 6ff8877..1e85c8e 100755
--- a/01-rkhunter
+++ b/01-rkhunter
@@ -19,7 +19,7 @@ if [ ! -e /var/lock/subsys/rkhunter ]; then
   fi
 
   # If a diagnostic mode scan was requested, setup the parameters
-  if [ "$DIAG_SCAN" == "yes" ]; then
+  if [ "$DIAG_SCAN" = "yes" ]; then
     RKHUNTER_FLAGS="--checkall --skip-keypress --nocolors --quiet --appendlog --display-logfile"
   else
     RKHUNTER_FLAGS="--cronjob --nocolors --report-warnings-only"
diff --git a/rkhunter.spec b/rkhunter.spec
index b956418..a229e8a 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -104,6 +104,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Sep 26 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-4
+- Fix cron script to work with non bash shells. Fixes bug #1146717
+
 * Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.2-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
 

From 50a96943d5b00dba61025e1ec30c4e7fb4ba4a23 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Mon, 27 Oct 2014 09:42:30 -0600
Subject: [PATCH 03/14] Set /var/lib/rkhunter to be mode 700. fixes bug
 #1154428

---
 rkhunter.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index a229e8a..af060e0 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -56,6 +56,7 @@ EOF
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8
+%{__mkdir} -m700 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/log/%{name}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n
@@ -104,6 +105,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Mon Oct 27 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-5
+- Set /var/lib/rkhunter to be mode 700. fixes bug #1154428
+
 * Fri Sep 26 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-4
 - Fix cron script to work with non bash shells. Fixes bug #1146717
 

From 6a006fbfea7c39c45c708c98a282ab9d4fec2583 Mon Sep 17 00:00:00 2001
From: Mukundan Ragavan <nonamedotc@fedoraproject.org>
Date: Thu, 31 Dec 2015 13:03:29 -0500
Subject: [PATCH 04/14] Allow /etc/.updated on EL7

- Fixes bug#1291629
---
 rkhunter-1.4.2-fedoraconfig.patch | 22 +++++++++-------------
 rkhunter.spec                     |  6 +++++-
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch
index 2117d1b..da521a8 100644
--- a/rkhunter-1.4.2-fedoraconfig.patch
+++ b/rkhunter-1.4.2-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf
 --- rkhunter-1.4.2.orig/files/rkhunter.conf	2014-01-25 14:29:51.000000000 -0700
-+++ rkhunter-1.4.2/files/rkhunter.conf	2014-04-06 11:43:15.719800756 -0600
++++ rkhunter-1.4.2/files/rkhunter.conf	2015-12-06 11:19:26.840917848 -0700
 @@ -155,6 +155,7 @@
  # default directory beneath the installation directory.
  #
@@ -41,14 +41,6 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  #APPEND_LOG=0
 +APPEND_LOG=1
  
- #
- # Set the following option to '1' if the log file is to be copied when rkhunter
-@@ -304,6 +307,7 @@
- # The default value is 'no'.
- #
- #ALLOW_SSH_ROOT_USER=no
-+ALLOW_SSH_ROOT_USER=unset
- 
  #
  # Set this option to '1' to allow the use of the SSH-1 protocol, but note
 @@ -318,6 +322,7 @@
@@ -125,7 +117,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -620,6 +654,30 @@
+@@ -620,6 +654,32 @@
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
  #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
@@ -153,10 +145,12 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
 +ALLOWHIDDENFILE=/etc/.etckeeper
 +ALLOWHIDDENFILE=/etc/.gitignore
 +ALLOWHIDDENFILE=/etc/.bzrignore
++# systemd
++ALLOWHIDDENFILE=/etc/.updated
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -681,6 +739,18 @@
+@@ -681,6 +741,20 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -172,10 +166,12 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
 +ALLOWDEVFILE="/dev/md/autorebuild.pid"
 +# 389 Directory Server
 +ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats
++# squid proxy
++ALLOWDEVFILE=/dev/shm/squid-cf*
  
  #
  # This option is used to indicate if the Phalanx2 test is to perform a basic
-@@ -1004,6 +1074,11 @@
+@@ -1004,6 +1078,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -187,7 +183,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1222,3 +1297,5 @@
+@@ -1222,3 +1301,5 @@
  #
  #EMPTY_LOGFILES=""
  #MISSING_LOGFILES=""
diff --git a/rkhunter.spec b/rkhunter.spec
index af060e0..d182e82 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -105,6 +105,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Thu Dec 31 2015 Mukundan Ragavan <nonamedotc@gmail.com> - 1.4.2-6
+- Allow /etc/.updated on EL7
+- Fixes bug#1291629
+
 * Mon Oct 27 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-5
 - Set /var/lib/rkhunter to be mode 700. fixes bug #1154428
 

From ef6697ff3b48d93611fa103184e1dd8c8bfbaac2 Mon Sep 17 00:00:00 2001
From: Mukundan Ragavan <nonamedotc@fedoraproject.org>
Date: Thu, 31 Dec 2015 18:52:03 -0500
Subject: [PATCH 05/14] Allow /etc/.updated on EL7

- Fixes bug#1291629
---
 ...fedoraconfig.patch => rkhunter-1.4.2-epel7.patch | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)
 rename rkhunter-1.4.2-fedoraconfig.patch => rkhunter-1.4.2-epel7.patch (93%)

diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-epel7.patch
similarity index 93%
rename from rkhunter-1.4.2-fedoraconfig.patch
rename to rkhunter-1.4.2-epel7.patch
index da521a8..bfa31d9 100644
--- a/rkhunter-1.4.2-fedoraconfig.patch
+++ b/rkhunter-1.4.2-epel7.patch
@@ -1,6 +1,5 @@
-diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf
---- rkhunter-1.4.2.orig/files/rkhunter.conf	2014-01-25 14:29:51.000000000 -0700
-+++ rkhunter-1.4.2/files/rkhunter.conf	2015-12-06 11:19:26.840917848 -0700
+--- rkhunter-1.4.2-orig/files/rkhunter.conf	2015-12-31 18:40:13.654509378 -0500
++++ rkhunter-1.4.2/files/rkhunter.conf	2015-12-31 18:50:31.433316460 -0500
 @@ -155,6 +155,7 @@
  # default directory beneath the installation directory.
  #
@@ -41,8 +40,16 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  #APPEND_LOG=0
 +APPEND_LOG=1
  
+ #
+ # Set the following option to '1' if the log file is to be copied when rkhunter
+@@ -305,6 +308,7 @@
+ #
+ #ALLOW_SSH_ROOT_USER=no
+ 
++
  #
  # Set this option to '1' to allow the use of the SSH-1 protocol, but note
+ # that theoretically it is weaker, and therefore less secure, than the
 @@ -318,6 +322,7 @@
  # The default value is '0'.
  #

From 0c33dc80a147606d268b6f3118ebe516691e43ef Mon Sep 17 00:00:00 2001
From: Mukundan Ragavan <nonamedotc@fedoraproject.org>
Date: Thu, 31 Dec 2015 18:52:53 -0500
Subject: [PATCH 06/14] Allow /etc/.updated on EL7

- Fixes bug#1291629
---
 rkhunter.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index d182e82..3089e27 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -12,7 +12,7 @@ URL:            http://rkhunter.sourceforge.net/
 Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
-Patch0:         rkhunter-1.4.2-fedoraconfig.patch
+Patch0:         rkhunter-1.4.2-epel7.patch
 #
 # Fix issue with ipcs command and locales
 #

From bdd7fb093aecbbb8014984ce7c8b165616e3bcc2 Mon Sep 17 00:00:00 2001
From: Mukundan Ragavan <nonamedotc@fedoraproject.org>
Date: Tue, 5 Jan 2016 21:50:55 -0500
Subject: [PATCH 07/14] Fix ssh config value in patch

---
 rkhunter-1.4.2-epel7.patch | 14 ++++++++------
 rkhunter.spec              |  5 ++++-
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/rkhunter-1.4.2-epel7.patch b/rkhunter-1.4.2-epel7.patch
index bfa31d9..f47f0eb 100644
--- a/rkhunter-1.4.2-epel7.patch
+++ b/rkhunter-1.4.2-epel7.patch
@@ -1,5 +1,5 @@
---- rkhunter-1.4.2-orig/files/rkhunter.conf	2015-12-31 18:40:13.654509378 -0500
-+++ rkhunter-1.4.2/files/rkhunter.conf	2015-12-31 18:50:31.433316460 -0500
+--- rkhunter-1.4.2-orig/files/rkhunter.conf	2016-01-05 21:43:02.431800445 -0500
++++ rkhunter-1.4.2/files/rkhunter.conf	2016-01-05 21:45:07.610163429 -0500
 @@ -155,6 +155,7 @@
  # default directory beneath the installation directory.
  #
@@ -42,14 +42,16 @@
  
  #
  # Set the following option to '1' if the log file is to be copied when rkhunter
-@@ -305,6 +308,7 @@
+@@ -303,7 +306,8 @@
  #
- #ALLOW_SSH_ROOT_USER=no
- 
+ # The default value is 'no'.
+ #
+-#ALLOW_SSH_ROOT_USER=no
++ALLOW_SSH_ROOT_USER=unset
 +
+ 
  #
  # Set this option to '1' to allow the use of the SSH-1 protocol, but note
- # that theoretically it is weaker, and therefore less secure, than the
 @@ -318,6 +322,7 @@
  # The default value is '0'.
  #
diff --git a/rkhunter.spec b/rkhunter.spec
index 3089e27..532cd5f 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        6%{?dist}
+Release:        7%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -105,6 +105,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Tue Jan 05 2016 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-7
+- Fix ssh config value in patch
+
 * Thu Dec 31 2015 Mukundan Ragavan <nonamedotc@gmail.com> - 1.4.2-6
 - Allow /etc/.updated on EL7
 - Fixes bug#1291629

From ec87440d10ee4948bdbaf16cfde2187a9d255d5e Mon Sep 17 00:00:00 2001
From: Mukundan Ragavan <nonamedotc@gmail.com>
Date: Wed, 25 Jan 2017 21:33:56 -0500
Subject: [PATCH 08/14] Add /dev/shm/qb* files to whitelist. Fixes bug #1403602
 Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug #1411130

---
 rkhunter-1.4.2-epel7.patch | 26 ++++++++++++++++++++------
 rkhunter.spec              |  6 +++++-
 2 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/rkhunter-1.4.2-epel7.patch b/rkhunter-1.4.2-epel7.patch
index f47f0eb..3fe5809 100644
--- a/rkhunter-1.4.2-epel7.patch
+++ b/rkhunter-1.4.2-epel7.patch
@@ -1,5 +1,5 @@
---- rkhunter-1.4.2-orig/files/rkhunter.conf	2016-01-05 21:43:02.431800445 -0500
-+++ rkhunter-1.4.2/files/rkhunter.conf	2016-01-05 21:45:07.610163429 -0500
+--- rkhunter-1.4.2.orig/files/rkhunter.conf	2017-01-25 21:03:14.142522097 -0500
++++ rkhunter-1.4.2/files/rkhunter.conf	2017-01-25 21:31:34.721348188 -0500
 @@ -155,6 +155,7 @@
  # default directory beneath the installation directory.
  #
@@ -126,7 +126,7 @@
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -620,6 +654,32 @@
+@@ -620,6 +654,44 @@
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
  #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
@@ -156,10 +156,22 @@
 +ALLOWHIDDENFILE=/etc/.bzrignore
 +# systemd
 +ALLOWHIDDENFILE=/etc/.updated
++
++# Allow PCS/Pacemaker/Corosync
++ALLOWDEVFILE=/dev/shm/qb-attrd-*
++ALLOWDEVFILE=/dev/shm/qb-cfg-*
++ALLOWDEVFILE=/dev/shm/qb-cib_rw-*
++ALLOWDEVFILE=/dev/shm/qb-cib_shm-*
++ALLOWDEVFILE=/dev/shm/qb-corosync-*
++ALLOWDEVFILE=/dev/shm/qb-cpg-*
++ALLOWDEVFILE=/dev/shm/qb-lrmd-*
++ALLOWDEVFILE=/dev/shm/qb-pengine-*
++ALLOWDEVFILE=/dev/shm/qb-quorum-*
++ALLOWDEVFILE=/dev/shm/qb-stonith-*
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -681,6 +741,20 @@
+@@ -681,6 +753,22 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -177,10 +189,12 @@
 +ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats
 +# squid proxy
 +ALLOWDEVFILE=/dev/shm/squid-cf*
++# squid ssl cache
++ALLOWDEVFILE=/dev/shm/squid-ssl_session_cache.shm
  
  #
  # This option is used to indicate if the Phalanx2 test is to perform a basic
-@@ -1004,6 +1078,11 @@
+@@ -1004,6 +1092,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -192,7 +206,7 @@
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1222,3 +1301,5 @@
+@@ -1222,3 +1315,5 @@
  #
  #EMPTY_LOGFILES=""
  #MISSING_LOGFILES=""
diff --git a/rkhunter.spec b/rkhunter.spec
index 532cd5f..3da7579 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -105,6 +105,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Jan 25 2017 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-8
+- Add /dev/shm/qb* files to whitelist. Fixes bug #1403602
+- Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug #1411130
+
 * Tue Jan 05 2016 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-7
 - Fix ssh config value in patch
 

From fe8a3880272717ac554a671f1c8f5005e849d32f Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Fri, 30 Jun 2017 15:59:08 -0600
Subject: [PATCH 09/14] - Update to 1.4.4. Fixes bug #1466318 - Fix for logger
 and spaces. Fixes bug #1284403

---
 .gitignore                                    |   1 +
 rkhunter-1.4.2-ipcs-locale.patch              |  18 ---
 ...-epel7.patch => rkhunter-1.4.4-epel7.patch | 108 +++++++-----------
 rkhunter.spec                                 |  19 ++-
 sources                                       |   2 +-
 5 files changed, 51 insertions(+), 97 deletions(-)
 delete mode 100644 rkhunter-1.4.2-ipcs-locale.patch
 rename rkhunter-1.4.2-epel7.patch => rkhunter-1.4.4-epel7.patch (74%)

diff --git a/.gitignore b/.gitignore
index 8ffe1c8..1422757 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@ rkhunter-1.3.6.tar.gz
 /rkhunter-1.3.8.tar.gz
 /rkhunter-1.4.0.tar.gz
 /rkhunter-1.4.2.tar.gz
+/rkhunter-1.4.4.tar.gz
diff --git a/rkhunter-1.4.2-ipcs-locale.patch b/rkhunter-1.4.2-ipcs-locale.patch
deleted file mode 100644
index 0457e4c..0000000
--- a/rkhunter-1.4.2-ipcs-locale.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff -Nur rkhunter-1.4.2.orig/files/rkhunter rkhunter-1.4.2/files/rkhunter
---- rkhunter-1.4.2.orig/files/rkhunter	2014-03-12 14:54:55.000000000 -0600
-+++ rkhunter-1.4.2/files/rkhunter	2014-04-06 11:39:44.776583858 -0600
-@@ -13964,11 +13964,11 @@
-                         touch "${IPCS_TMPFILE}"
-                         FOUND=0; echo $FOUND > "${IPCS_TMPFILE}"
- 
--                        if [ `${IPCS_CMD} -u 2>/dev/null | awk -F' ' '/segments allocated/ {print $3}'` -ne 0 ]; then
--                                ${IPCS_CMD} -m | grep "^0x" | while read RKH_SHM_KEY RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_PERMS RKH_SHM_BYTES RKH_SHM_NATTACH RKH_SHM_STATUS; do
-+                        if [ `LC_ALL=C ${IPCS_CMD} -u 2>/dev/null | awk -F' ' '/segments allocated/ {print $3}'` -ne 0 ]; then
-+                                LC_ALL=C ${IPCS_CMD} -m | grep "^0x" | while read RKH_SHM_KEY RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_PERMS RKH_SHM_BYTES RKH_SHM_NATTACH RKH_SHM_STATUS; do
-                                         if [ $RKH_SHM_PERMS -eq 666 -a $RKH_SHM_BYTES -ge 1000000 ]; then
-                                                 FOUND=1; echo $FOUND > "${IPCS_TMPFILE}"
--                                                ${IPCS_CMD} -p | grep "^${RKH_SHM_SHMID}" | while read RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_CPID RKH_SHM_LPID; do
-+                                                LC_ALL=C ${IPCS_CMD} -p | grep "^${RKH_SHM_SHMID}" | while read RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_CPID RKH_SHM_LPID; do
-                                                         RKH_SHM_PATH=`${READLINK_CMD} -f /proc/${RKH_SHM_CPID}/exe`
-                                                         if [ $VERBOSE_LOGGING -eq 1 ]; then
-                                                                 display --to LOG --type PLAIN --result FOUND --log-indent 2 ROOTKIT_MALWARE_IPCS_DETAILS "${RKH_SHM_PATH}" "${RKH_SHM_CPID}" "${RKH_SHM_OWNER}"
diff --git a/rkhunter-1.4.2-epel7.patch b/rkhunter-1.4.4-epel7.patch
similarity index 74%
rename from rkhunter-1.4.2-epel7.patch
rename to rkhunter-1.4.4-epel7.patch
index 3fe5809..7f6b6ec 100644
--- a/rkhunter-1.4.2-epel7.patch
+++ b/rkhunter-1.4.4-epel7.patch
@@ -1,6 +1,13 @@
---- rkhunter-1.4.2.orig/files/rkhunter.conf	2017-01-25 21:03:14.142522097 -0500
-+++ rkhunter-1.4.2/files/rkhunter.conf	2017-01-25 21:31:34.721348188 -0500
-@@ -155,6 +155,7 @@
+diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.conf
+--- rkhunter-1.4.4.orig/files/rkhunter.conf	2017-06-22 18:19:20.000000000 -0600
++++ rkhunter-1.4.4/files/rkhunter.conf	2017-06-30 15:44:08.547591493 -0600
+@@ -1,4 +1,4 @@
+-#
++##
+ # This is the main configuration file for Rootkit Hunter.
+ #
+ # You can modify this file directly, or you can create a local configuration
+@@ -158,6 +158,7 @@
  # default directory beneath the installation directory.
  #
  #TMPDIR=/var/lib/rkhunter/tmp
@@ -8,81 +15,46 @@
  
  #
  # This option specifies the database directory to use.
-@@ -163,7 +164,7 @@
- # subsequently commented out or removed, then the program will assume a
+@@ -167,6 +168,7 @@
  # default directory beneath the installation directory.
  #
--#DBDIR=/var/lib/rkhunter/db
+ #DBDIR=/var/lib/rkhunter/db
 +DBDIR=/var/lib/rkhunter/db
  
  #
  # This option specifies the script directory to use.
-@@ -172,6 +173,7 @@
- # subsequently commented out or removed, then the program will not run.
- #
- #SCRIPTDIR=/usr/local/lib/rkhunter/scripts
-+SCRIPTDIR=/usr/share/rkhunter/scripts
- 
- #
- # This option can be used to modify the command directory list used by rkhunter
-@@ -228,7 +230,7 @@
- #
- # The default value is '/var/log/rkhunter.log'.
- #
--LOGFILE=/var/log/rkhunter.log
-+LOGFILE=/var/log/rkhunter/rkhunter.log
- 
- #
- # Set this option to '1' if the log file is to be appended to whenever rkhunter
-@@ -238,6 +240,7 @@
+@@ -241,6 +243,7 @@
  # The default value is '0'.
  #
  #APPEND_LOG=0
-+APPEND_LOG=1
++APPEND_LOG=0
  
  #
  # Set the following option to '1' if the log file is to be copied when rkhunter
-@@ -303,7 +306,8 @@
- #
- # The default value is 'no'.
- #
--#ALLOW_SSH_ROOT_USER=no
-+ALLOW_SSH_ROOT_USER=unset
-+
- 
- #
- # Set this option to '1' to allow the use of the SSH-1 protocol, but note
-@@ -318,6 +322,7 @@
+@@ -321,6 +324,7 @@
  # The default value is '0'.
  #
  #ALLOW_SSH_PROT_V1=0
-+ALLOW_SSH_PROT_V1=2
++ALLOW_SSH_PROT_V1=unset
  
  #
  # This setting tells rkhunter the directory containing the SSH configuration
-@@ -350,7 +355,8 @@
+@@ -353,7 +357,8 @@
  # program defaults.
  #
  ENABLE_TESTS=ALL
--DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps
-+#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps
+-DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps
++#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps
 +DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps
  
  #
  # The HASH_CMD option can be used to specify the command to use for the file
-@@ -422,6 +428,7 @@
- # Also see the PKGMGR_NO_VRFY and USE_SUNSUM options.
- #
- #PKGMGR=NONE
-+PKGMGR=RPM
- 
- #
- # It is possible that a file, which is part of a package, may have been
-@@ -545,6 +552,14 @@
+@@ -557,6 +562,15 @@
  # The default value is the null string.
  #
  #EXISTWHITELIST=""
-+EXISTWHITELIST=/bin/ad
++XISTWHITELIST=""
+++EXISTWHITELIST=/bin/ad
 +# FreeIPA Certificate Authority
 +EXISTWHITELIST=/var/log/pki-ca/system
 +# FreeIPA Certificate Authority
@@ -93,7 +65,7 @@
  
  #
  # Whitelist various attributes of the specified file. The attributes are those
-@@ -575,6 +590,12 @@
+@@ -587,6 +601,12 @@
  # The default value is the null string.
  #
  #SCRIPTWHITELIST=/usr/bin/groups
@@ -106,7 +78,7 @@
  
  #
  # Allow the specified file to have the immutable attribute set.
-@@ -605,6 +626,19 @@
+@@ -617,6 +637,19 @@
  #ALLOWHIDDENDIR=/dev/.udev
  #ALLOWHIDDENDIR=/dev/.udevdb
  #ALLOWHIDDENDIR=/dev/.mdadm
@@ -126,10 +98,12 @@
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -620,6 +654,44 @@
+@@ -631,7 +664,33 @@
+ #ALLOWHIDDENFILE=/usr/lib/.libfipscheck.so.1.1.0.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
- #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
+-#ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
++ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
 +ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz"
 +ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac
 +ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac
@@ -156,7 +130,13 @@
 +ALLOWHIDDENFILE=/etc/.bzrignore
 +# systemd
 +ALLOWHIDDENFILE=/etc/.updated
-+
+ 
+ #
+ # Allow the specified process to use deleted files. The process name may be
+@@ -701,6 +760,33 @@
+ #
+ #ALLOWDEVFILE=/dev/shm/pulse-shm-*
+ #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
 +# Allow PCS/Pacemaker/Corosync
 +ALLOWDEVFILE=/dev/shm/qb-attrd-*
 +ALLOWDEVFILE=/dev/shm/qb-cfg-*
@@ -168,13 +148,6 @@
 +ALLOWDEVFILE=/dev/shm/qb-pengine-*
 +ALLOWDEVFILE=/dev/shm/qb-quorum-*
 +ALLOWDEVFILE=/dev/shm/qb-stonith-*
- 
- #
- # Allow the specified process to use deleted files. The process name may be
-@@ -681,6 +753,22 @@
- #
- #ALLOWDEVFILE=/dev/shm/pulse-shm-*
- #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
 +ALLOWDEVFILE=/dev/shm/pulse-shm-*
 +ALLOWDEVFILE=/dev/md/md-device-map
 +# tomboy creates this one
@@ -193,8 +166,8 @@
 +ALLOWDEVFILE=/dev/shm/squid-ssl_session_cache.shm
  
  #
- # This option is used to indicate if the Phalanx2 test is to perform a basic
-@@ -1004,6 +1092,11 @@
+ # Allow the specified process pathnames to use shared memory segments.
+@@ -1035,6 +1121,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -206,9 +179,10 @@
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1222,3 +1315,5 @@
+@@ -1274,3 +1365,6 @@
+ # The default value is '0'.
  #
- #EMPTY_LOGFILES=""
- #MISSING_LOGFILES=""
+ #GLOBSTAR=0
++
 +
 +INSTALLDIR="/usr"
diff --git a/rkhunter.spec b/rkhunter.spec
index 3da7579..d272872 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -2,8 +2,8 @@
 %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
 
 Name:           rkhunter
-Version:        1.4.2
-Release:        8%{?dist}
+Version:        1.4.4
+Release:        1%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -12,11 +12,7 @@ URL:            http://rkhunter.sourceforge.net/
 Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
-Patch0:         rkhunter-1.4.2-epel7.patch
-#
-# Fix issue with ipcs command and locales
-#
-Patch1:         rkhunter-1.4.2-ipcs-locale.patch
+Patch0:         rkhunter-1.4.4-epel7.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -32,10 +28,7 @@ and other unwanted tools.
 
 %prep
 
-%setup -q
-
-%patch0 -p1
-%patch1 -p1
+%autosetup -p1
 
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}/%{name}.log {
@@ -105,6 +98,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jun 30 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-1
+- Update to 1.4.4. Fixes bug #1466318
+- Fix for logger and spaces. Fixes bug #1284403
+
 * Wed Jan 25 2017 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-8
 - Add /dev/shm/qb* files to whitelist. Fixes bug #1403602
 - Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug #1411130
diff --git a/sources b/sources
index 873ec5b..458900a 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-85ad366b7f3999eb2a9371e39a1a4df7  rkhunter-1.4.2.tar.gz
+SHA512 (rkhunter-1.4.4.tar.gz) = 87e9c617220765678cc4519eee27d1d56185c3a7fb1d6338c8fb984ac4f5176c31bb54b69e1de615d66a0cf1e72b672e66b368e37851a459def69463cbb8661e

From 9ac7bb38376bd2706e735b06b8c1abb4baddb376 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Mon, 3 Jul 2017 16:37:12 -0600
Subject: [PATCH 10/14] Correct some rebasing errors on config.

---
 rkhunter-1.4.4-epel7.patch | 63 ++++++++++++++++++++++++++++----------
 rkhunter.spec              |  5 ++-
 2 files changed, 51 insertions(+), 17 deletions(-)

diff --git a/rkhunter-1.4.4-epel7.patch b/rkhunter-1.4.4-epel7.patch
index 7f6b6ec..df143de 100644
--- a/rkhunter-1.4.4-epel7.patch
+++ b/rkhunter-1.4.4-epel7.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.conf
 --- rkhunter-1.4.4.orig/files/rkhunter.conf	2017-06-22 18:19:20.000000000 -0600
-+++ rkhunter-1.4.4/files/rkhunter.conf	2017-06-30 15:44:08.547591493 -0600
++++ rkhunter-1.4.4/files/rkhunter.conf	2017-07-03 16:24:55.479267452 -0600
 @@ -1,4 +1,4 @@
 -#
 +##
@@ -23,23 +23,48 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # This option specifies the script directory to use.
-@@ -241,6 +243,7 @@
+@@ -175,6 +177,7 @@
+ # subsequently commented out or removed, then the program will not run.
+ #
+ #SCRIPTDIR=/usr/local/lib/rkhunter/scripts
++SCRIPTDIR=/usr/share/rkhunter/scripts
+ 
+ #
+ # This option can be used to modify the command directory list used by rkhunter
+@@ -231,7 +234,7 @@
+ #
+ # The default value is '/var/log/rkhunter.log'.
+ #
+-LOGFILE=/var/log/rkhunter.log
++LOGFILE=/var/log/rkhunter/rkhunter.log
+ 
+ #
+ # Set this option to '1' if the log file is to be appended to whenever rkhunter
+@@ -241,6 +244,7 @@
  # The default value is '0'.
  #
  #APPEND_LOG=0
-+APPEND_LOG=0
++APPEND_LOG=1
  
  #
  # Set the following option to '1' if the log file is to be copied when rkhunter
-@@ -321,6 +324,7 @@
+@@ -307,6 +311,7 @@
+ # The default value is 'no'.
+ #
+ #ALLOW_SSH_ROOT_USER=no
++ALLOW_SSH_ROOT_USER=unset
+ 
+ #
+ # Set this option to '1' to allow the use of the SSH-1 protocol, but note
+@@ -321,6 +326,7 @@
  # The default value is '0'.
  #
  #ALLOW_SSH_PROT_V1=0
-+ALLOW_SSH_PROT_V1=unset
++ALLOW_SSH_PROT_V1=2
  
  #
  # This setting tells rkhunter the directory containing the SSH configuration
-@@ -353,7 +357,8 @@
+@@ -353,7 +359,8 @@
  # program defaults.
  #
  ENABLE_TESTS=ALL
@@ -49,12 +74,19 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # The HASH_CMD option can be used to specify the command to use for the file
-@@ -557,6 +562,15 @@
+@@ -434,6 +441,7 @@
+ # Also see the PKGMGR_NO_VRFY and USE_SUNSUM options.
+ #
+ #PKGMGR=NONE
++PKGMGR=RPM
+ 
+ #
+ # It is possible that a file, which is part of a package, may have been
+@@ -557,6 +565,14 @@
  # The default value is the null string.
  #
  #EXISTWHITELIST=""
-+XISTWHITELIST=""
-++EXISTWHITELIST=/bin/ad
++EXISTWHITELIST=/bin/ad
 +# FreeIPA Certificate Authority
 +EXISTWHITELIST=/var/log/pki-ca/system
 +# FreeIPA Certificate Authority
@@ -65,7 +97,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # Whitelist various attributes of the specified file. The attributes are those
-@@ -587,6 +601,12 @@
+@@ -587,6 +603,12 @@
  # The default value is the null string.
  #
  #SCRIPTWHITELIST=/usr/bin/groups
@@ -78,7 +110,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # Allow the specified file to have the immutable attribute set.
-@@ -617,6 +637,19 @@
+@@ -617,6 +639,19 @@
  #ALLOWHIDDENDIR=/dev/.udev
  #ALLOWHIDDENDIR=/dev/.udevdb
  #ALLOWHIDDENDIR=/dev/.mdadm
@@ -98,7 +130,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -631,7 +664,33 @@
+@@ -631,7 +666,33 @@
  #ALLOWHIDDENFILE=/usr/lib/.libfipscheck.so.1.1.0.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
@@ -133,7 +165,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -701,6 +760,33 @@
+@@ -701,6 +762,33 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -167,7 +199,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # Allow the specified process pathnames to use shared memory segments.
-@@ -1035,6 +1121,11 @@
+@@ -1035,6 +1123,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -179,10 +211,9 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1274,3 +1365,6 @@
+@@ -1274,3 +1367,5 @@
  # The default value is '0'.
  #
  #GLOBSTAR=0
 +
-+
 +INSTALLDIR="/usr"
diff --git a/rkhunter.spec b/rkhunter.spec
index d272872..ea51801 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.4
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -98,6 +98,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Mon Jul 03 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-2
+- Correct some rebasing errors on config.
+
 * Fri Jun 30 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-1
 - Update to 1.4.4. Fixes bug #1466318
 - Fix for logger and spaces. Fixes bug #1284403

From c595a19f4043a4e763e7439222a09f94a2de43fd Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 12 Aug 2017 12:27:55 -0700
Subject: [PATCH 11/14] Disable ipc_shared_mem test for now due to false
 positives. Bug #1472299

---
 rkhunter-1.4.4-epel7.patch | 6 +++---
 rkhunter.spec              | 5 ++++-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/rkhunter-1.4.4-epel7.patch b/rkhunter-1.4.4-epel7.patch
index df143de..7ea8b9e 100644
--- a/rkhunter-1.4.4-epel7.patch
+++ b/rkhunter-1.4.4-epel7.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.conf
---- rkhunter-1.4.4.orig/files/rkhunter.conf	2017-06-22 18:19:20.000000000 -0600
-+++ rkhunter-1.4.4/files/rkhunter.conf	2017-07-03 16:24:55.479267452 -0600
+--- rkhunter-1.4.4.orig/files/rkhunter.conf	2017-06-22 17:19:20.000000000 -0700
++++ rkhunter-1.4.4/files/rkhunter.conf	2017-08-12 12:27:07.923668847 -0700
 @@ -1,4 +1,4 @@
 -#
 +##
@@ -70,7 +70,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  ENABLE_TESTS=ALL
 -DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps
 +#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps
-+DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps
++DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps ipc_shared_mem
  
  #
  # The HASH_CMD option can be used to specify the command to use for the file
diff --git a/rkhunter.spec b/rkhunter.spec
index ea51801..851849c 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.4
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -98,6 +98,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Aug 12 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-3
+- Disable ipc_shared_mem test for now due to false positives. Bug #1472299
+
 * Mon Jul 03 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-2
 - Correct some rebasing errors on config.
 

From 3567813bd706dee61b585c1379d4f0d464cc5ff1 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sun, 25 Feb 2018 15:41:08 -0800
Subject: [PATCH 12/14] Upgrade to 1.4.6. Fixes bug #1524456 Allow KRA vault
 log files. Fixes bug #1541472 ipc_shared_mem warning fixed upstream. Fixes
 bug #1524456

---
 .gitignore                                    |  1 +
 ...-epel7.patch => rkhunter-1.4.6-epel7.patch | 25 +++++++++++--------
 rkhunter.spec                                 | 11 +++++---
 sources                                       |  2 +-
 4 files changed, 24 insertions(+), 15 deletions(-)
 rename rkhunter-1.4.4-epel7.patch => rkhunter-1.4.6-epel7.patch (92%)

diff --git a/.gitignore b/.gitignore
index 1422757..0486fc1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@ rkhunter-1.3.6.tar.gz
 /rkhunter-1.4.0.tar.gz
 /rkhunter-1.4.2.tar.gz
 /rkhunter-1.4.4.tar.gz
+/rkhunter-1.4.6.tar.gz
diff --git a/rkhunter-1.4.4-epel7.patch b/rkhunter-1.4.6-epel7.patch
similarity index 92%
rename from rkhunter-1.4.4-epel7.patch
rename to rkhunter-1.4.6-epel7.patch
index 7ea8b9e..e6c4713 100644
--- a/rkhunter-1.4.4-epel7.patch
+++ b/rkhunter-1.4.6-epel7.patch
@@ -1,6 +1,6 @@
-diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.conf
---- rkhunter-1.4.4.orig/files/rkhunter.conf	2017-06-22 17:19:20.000000000 -0700
-+++ rkhunter-1.4.4/files/rkhunter.conf	2017-08-12 12:27:07.923668847 -0700
+diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf
+--- rkhunter-1.4.6.orig/files/rkhunter.conf	2018-02-19 15:49:06.000000000 -0800
++++ rkhunter-1.4.6/files/rkhunter.conf	2018-02-25 15:23:23.886798270 -0800
 @@ -1,4 +1,4 @@
 -#
 +##
@@ -74,7 +74,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # The HASH_CMD option can be used to specify the command to use for the file
-@@ -434,6 +441,7 @@
+@@ -435,6 +442,7 @@
  # Also see the PKGMGR_NO_VRFY and USE_SUNSUM options.
  #
  #PKGMGR=NONE
@@ -82,7 +82,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # It is possible that a file, which is part of a package, may have been
-@@ -557,6 +565,14 @@
+@@ -558,6 +566,14 @@
  # The default value is the null string.
  #
  #EXISTWHITELIST=""
@@ -97,7 +97,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # Whitelist various attributes of the specified file. The attributes are those
-@@ -587,6 +603,12 @@
+@@ -588,6 +604,12 @@
  # The default value is the null string.
  #
  #SCRIPTWHITELIST=/usr/bin/groups
@@ -110,7 +110,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # Allow the specified file to have the immutable attribute set.
-@@ -617,6 +639,19 @@
+@@ -630,6 +652,19 @@
  #ALLOWHIDDENDIR=/dev/.udev
  #ALLOWHIDDENDIR=/dev/.udevdb
  #ALLOWHIDDENDIR=/dev/.mdadm
@@ -130,7 +130,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -631,7 +666,33 @@
+@@ -644,7 +679,33 @@
  #ALLOWHIDDENFILE=/usr/lib/.libfipscheck.so.1.1.0.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
@@ -165,7 +165,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -701,6 +762,33 @@
+@@ -714,6 +775,33 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -199,7 +199,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # Allow the specified process pathnames to use shared memory segments.
-@@ -1035,6 +1123,11 @@
+@@ -1090,6 +1178,14 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -208,10 +208,13 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
 +RTKT_FILE_WHITELIST=/var/log/pki-ca/system
 +# FreeIPA Certificate Authority
 +RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/ca/system
++# FreeIPA with KRA (Password Vault)
++EXISTWHITELIST=/var/log/pki/pki-tomcat/kra/system
++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/kra/system
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1274,3 +1367,5 @@
+@@ -1329,3 +1425,5 @@
  # The default value is '0'.
  #
  #GLOBSTAR=0
diff --git a/rkhunter.spec b/rkhunter.spec
index 851849c..87e1905 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -2,8 +2,8 @@
 %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
 
 Name:           rkhunter
-Version:        1.4.4
-Release:        3%{?dist}
+Version:        1.4.6
+Release:        1%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -12,7 +12,7 @@ URL:            http://rkhunter.sourceforge.net/
 Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
-Patch0:         rkhunter-1.4.4-epel7.patch
+Patch0:         rkhunter-1.4.6-epel7.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -98,6 +98,11 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Feb 25 2018 Kevin Fenzi <kevin@scrye.com> - 1.4.6-1
+- Upgrade to 1.4.6. Fixes bug #1524456
+- Allow KRA vault log files. Fixes bug #1541472
+- ipc_shared_mem warning fixed upstream. Fixes bug #1524456
+
 * Sat Aug 12 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-3
 - Disable ipc_shared_mem test for now due to false positives. Bug #1472299
 
diff --git a/sources b/sources
index 458900a..956755f 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (rkhunter-1.4.4.tar.gz) = 87e9c617220765678cc4519eee27d1d56185c3a7fb1d6338c8fb984ac4f5176c31bb54b69e1de615d66a0cf1e72b672e66b368e37851a459def69463cbb8661e
+SHA512 (rkhunter-1.4.6.tar.gz) = c51a21b6b66ed1f73a19d8ce04eaba35999eefcb666acc824989c3bf53ac56d24a33ac4fec290be942e33fe24674406b371eafff73f7e697b9e03ec031b37216

From 519e0ac94705a5a9e4c22c4bb2f82deadb69ff46 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 16 May 2020 14:38:47 -0700
Subject: [PATCH 13/14] Add allow for podman's /dev/shm files (fixes bug
 #1828698 )

---
 rkhunter-1.4.6-epel7.patch | 10 ++++++----
 rkhunter.spec              |  5 ++++-
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/rkhunter-1.4.6-epel7.patch b/rkhunter-1.4.6-epel7.patch
index e6c4713..8fc498c 100644
--- a/rkhunter-1.4.6-epel7.patch
+++ b/rkhunter-1.4.6-epel7.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf
 --- rkhunter-1.4.6.orig/files/rkhunter.conf	2018-02-19 15:49:06.000000000 -0800
-+++ rkhunter-1.4.6/files/rkhunter.conf	2018-02-25 15:23:23.886798270 -0800
++++ rkhunter-1.4.6/files/rkhunter.conf	2020-05-16 14:20:16.767707769 -0700
 @@ -1,4 +1,4 @@
 -#
 +##
@@ -165,7 +165,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -714,6 +775,33 @@
+@@ -714,6 +775,35 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -196,10 +196,12 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
 +ALLOWDEVFILE=/dev/shm/squid-cf*
 +# squid ssl cache
 +ALLOWDEVFILE=/dev/shm/squid-ssl_session_cache.shm
++# Allow podman
++ALLOWDEVFILE=/dev/shm/libpod*lock*
  
  #
  # Allow the specified process pathnames to use shared memory segments.
-@@ -1090,6 +1178,14 @@
+@@ -1090,6 +1180,14 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -214,7 +216,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1329,3 +1425,5 @@
+@@ -1329,3 +1427,5 @@
  # The default value is '0'.
  #
  #GLOBSTAR=0
diff --git a/rkhunter.spec b/rkhunter.spec
index 87e1905..e4fbd88 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -98,6 +98,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat May 16 2020 Kevin Fenzi <kevin@scrye.com> - 1.4.6-2
+- Add allow for podman's /dev/shm files (fixes bug #1828698 )
+
 * Sun Feb 25 2018 Kevin Fenzi <kevin@scrye.com> - 1.4.6-1
 - Upgrade to 1.4.6. Fixes bug #1524456
 - Allow KRA vault log files. Fixes bug #1541472

From 02a3bdd18111e86c000555808e4b579acf6d37f2 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Tue, 4 May 2021 16:30:18 -0700
Subject: [PATCH 14/14] Add patch to fix false positive for libkeyutils

---
 rkhunter-1.4.6-drop-libkeyutils-check.patch | 43 +++++++++++++++++++++
 rkhunter.spec                               |  6 ++-
 2 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 rkhunter-1.4.6-drop-libkeyutils-check.patch

diff --git a/rkhunter-1.4.6-drop-libkeyutils-check.patch b/rkhunter-1.4.6-drop-libkeyutils-check.patch
new file mode 100644
index 0000000..b35ceaa
--- /dev/null
+++ b/rkhunter-1.4.6-drop-libkeyutils-check.patch
@@ -0,0 +1,43 @@
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6.orig/files/rkhunter	2018-02-24 15:08:27.000000000 -0800
++++ rkhunter-1.4.6/files/rkhunter	2021-01-15 12:47:54.399665856 -0800
+@@ -8370,9 +8370,7 @@
+ 		     /lib/libsbr.so
+ 		     /lib64/libsbr.so
+ 		     /lib/libslr.so
+-		     /lib64/libslr.so
+-		     /lib/tls/libkeyutils.so.1
+-		     /lib64/tls/libkeyutils.so.1"
++		     /lib64/libslr.so"
+ 	EBURY_DIRS=
+ 	EBURY_KSYMS=
+ 
+@@ -9762,10 +9760,6 @@
+ 		  file:/usr/share/sshd.sync:Trojaned SSH daemon
+ 		  file:/bin/zcut:Trojaned SSH daemon
+ 		  file:/usr/bin/zmuie:Trojaned SSH daemon
+-		  file:/lib/libkeyutils.so.1.9:Sniffer component
+-		  file:/lib64/libkeyutils.so.1.9:Sniffer component
+-		  file:/usr/lib/libkeyutils.so.1.9:Sniffer component
+-		  file:/usr/lib64/libkeyutils.so.1.9:Sniffer component
+ 		  file:/IptabLes:malware component
+ 		  file:/.IptabLex:malware component
+ 		  file:/boot/.IptabLex:malware component
+@@ -9956,7 +9950,6 @@
+ 			 ssh-scan:Port scanner
+ 			 atac:Port scanner component
+ 			 \[pdflush\]:IRC bot
+-			 libkeyutils.so.1.9:Spam tool component
+ 			 .IptabLex:malware component
+ 			 .IptabLes:malware component
+ 			 .flush:malware component
+diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb
+--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb	2017-11-29 08:14:02.000000000 -0800
++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb	1969-12-31 16:00:00.000000000 -0800
+@@ -1 +0,0 @@
+-RKH_libkeyutils.so.1.9-v1;Target:0;(((0&1&2)|(3&4&5))&((6&7&8)|(9&10)));58636174;58766572;58626e64;73686d6174;73686d6474;73686d676574;62696e64;636f6e6e656374;736f636b6574;737973636f6e66;746d7066696c65
+diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb
+--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb	2017-11-29 08:14:02.000000000 -0800
++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb	1969-12-31 16:00:00.000000000 -0800
+@@ -1 +0,0 @@
+-RKH_libkeyutils.1.9.so;Target:0;(0&1&2&3&4&5&6&7&8&9&10&11&12&13&14&15&16);737973636f6e66;746d7066696c65;77616974706964;736f636b6574;636f6e6e656374;73686d6174;73686d6474;73686d676574;73656d676574;73656d74696d65646f70;736c656570;737072696e7466;7372616e64;7374646f7574;737472636174;737472637079;5f5f737472647570
diff --git a/rkhunter.spec b/rkhunter.spec
index e4fbd88..c83b90e 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -13,6 +13,7 @@ Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.ta
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
 Patch0:         rkhunter-1.4.6-epel7.patch
+Patch1:         rkhunter-1.4.6-drop-libkeyutils-check.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -98,6 +99,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Tue May 04 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-3
+- Add patch to fix false positive for libkeyutils
+
 * Sat May 16 2020 Kevin Fenzi <kevin@scrye.com> - 1.4.6-2
 - Add allow for podman's /dev/shm files (fixes bug #1828698 )