From 17b3bec11261a65e30d5c9cb98239663feff117a Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 6 Apr 2014 11:53:08 -0600 Subject: [PATCH 01/54] Add patch to fix ipcs command in non en locales - Add config to fix freeipa installs. Fixes bug #994567 --- rkhunter-1.4.2-fedoraconfig.patch | 27 ++++++++++++++++++--------- rkhunter-1.4.2-ipcs-locale.patch | 18 ++++++++++++++++++ rkhunter.spec | 13 +++++++++++-- 3 files changed, 47 insertions(+), 11 deletions(-) create mode 100644 rkhunter-1.4.2-ipcs-locale.patch diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch index d6e6f07..2117d1b 100644 --- a/rkhunter-1.4.2-fedoraconfig.patch +++ b/rkhunter-1.4.2-fedoraconfig.patch @@ -1,6 +1,6 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf ---- rkhunter-1.4.2.orig/files/rkhunter.conf 2014-02-23 19:38:01.000000000 -0700 -+++ rkhunter-1.4.2/files/rkhunter.conf 2014-03-05 17:23:47.171809385 -0700 +--- rkhunter-1.4.2.orig/files/rkhunter.conf 2014-01-25 14:29:51.000000000 -0700 ++++ rkhunter-1.4.2/files/rkhunter.conf 2014-04-06 11:43:15.719800756 -0600 @@ -155,6 +155,7 @@ # default directory beneath the installation directory. # @@ -77,17 +77,22 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # It is possible that a file, which is part of a package, may have been -@@ -545,6 +552,9 @@ +@@ -545,6 +552,14 @@ # The default value is the null string. # #EXISTWHITELIST="" +EXISTWHITELIST=/bin/ad +# FreeIPA Certificate Authority +EXISTWHITELIST=/var/log/pki-ca/system ++# FreeIPA Certificate Authority ++EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system ++# Some non default installed files we check ++EXISTWHITELIST=/usr/bin/GET ++EXISTWHITELIST=/usr/bin/whatis # # Whitelist various attributes of the specified file. The attributes are those -@@ -575,6 +585,12 @@ +@@ -575,6 +590,12 @@ # The default value is the null string. # #SCRIPTWHITELIST=/usr/bin/groups @@ -100,7 +105,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # Allow the specified file to have the immutable attribute set. -@@ -605,6 +621,19 @@ +@@ -605,6 +626,19 @@ #ALLOWHIDDENDIR=/dev/.udev #ALLOWHIDDENDIR=/dev/.udevdb #ALLOWHIDDENDIR=/dev/.mdadm @@ -120,7 +125,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # Allow the specified hidden file to be whitelisted. -@@ -620,6 +649,30 @@ +@@ -620,6 +654,30 @@ #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac @@ -151,7 +156,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # Allow the specified process to use deleted files. The process name may be -@@ -681,6 +734,16 @@ +@@ -681,6 +739,18 @@ # #ALLOWDEVFILE=/dev/shm/pulse-shm-* #ALLOWDEVFILE=/dev/shm/sem.ADBE_* @@ -165,20 +170,24 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. +ALLOWDEVFILE="/dev/shm/spice.*" +# created by mdadm +ALLOWDEVFILE="/dev/md/autorebuild.pid" ++# 389 Directory Server ++ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats # # This option is used to indicate if the Phalanx2 test is to perform a basic -@@ -1004,6 +1067,9 @@ +@@ -1004,6 +1074,11 @@ # #RTKT_DIR_WHITELIST="" #RTKT_FILE_WHITELIST="" +RTKT_FILE_WHITELIST=/bin/ad +# FreeIPA Certificate Authority +RTKT_FILE_WHITELIST=/var/log/pki-ca/system ++# FreeIPA Certificate Authority ++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/ca/system # # The following option can be used to whitelist shared library files that would -@@ -1222,3 +1288,5 @@ +@@ -1222,3 +1297,5 @@ # #EMPTY_LOGFILES="" #MISSING_LOGFILES="" diff --git a/rkhunter-1.4.2-ipcs-locale.patch b/rkhunter-1.4.2-ipcs-locale.patch new file mode 100644 index 0000000..0457e4c --- /dev/null +++ b/rkhunter-1.4.2-ipcs-locale.patch @@ -0,0 +1,18 @@ +diff -Nur rkhunter-1.4.2.orig/files/rkhunter rkhunter-1.4.2/files/rkhunter +--- rkhunter-1.4.2.orig/files/rkhunter 2014-03-12 14:54:55.000000000 -0600 ++++ rkhunter-1.4.2/files/rkhunter 2014-04-06 11:39:44.776583858 -0600 +@@ -13964,11 +13964,11 @@ + touch "${IPCS_TMPFILE}" + FOUND=0; echo $FOUND > "${IPCS_TMPFILE}" + +- if [ `${IPCS_CMD} -u 2>/dev/null | awk -F' ' '/segments allocated/ {print $3}'` -ne 0 ]; then +- ${IPCS_CMD} -m | grep "^0x" | while read RKH_SHM_KEY RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_PERMS RKH_SHM_BYTES RKH_SHM_NATTACH RKH_SHM_STATUS; do ++ if [ `LC_ALL=C ${IPCS_CMD} -u 2>/dev/null | awk -F' ' '/segments allocated/ {print $3}'` -ne 0 ]; then ++ LC_ALL=C ${IPCS_CMD} -m | grep "^0x" | while read RKH_SHM_KEY RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_PERMS RKH_SHM_BYTES RKH_SHM_NATTACH RKH_SHM_STATUS; do + if [ $RKH_SHM_PERMS -eq 666 -a $RKH_SHM_BYTES -ge 1000000 ]; then + FOUND=1; echo $FOUND > "${IPCS_TMPFILE}" +- ${IPCS_CMD} -p | grep "^${RKH_SHM_SHMID}" | while read RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_CPID RKH_SHM_LPID; do ++ LC_ALL=C ${IPCS_CMD} -p | grep "^${RKH_SHM_SHMID}" | while read RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_CPID RKH_SHM_LPID; do + RKH_SHM_PATH=`${READLINK_CMD} -f /proc/${RKH_SHM_CPID}/exe` + if [ $VERBOSE_LOGGING -eq 1 ]; then + display --to LOG --type PLAIN --result FOUND --log-indent 2 ROOTKIT_MALWARE_IPCS_DETAILS "${RKH_SHM_PATH}" "${RKH_SHM_CPID}" "${RKH_SHM_OWNER}" diff --git a/rkhunter.spec b/rkhunter.spec index f322617..e4a1e6e 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -13,6 +13,10 @@ Source0: http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.ta Source2: 01-rkhunter Source3: rkhunter.sysconfig Patch0: rkhunter-1.4.2-fedoraconfig.patch +# +# Fix issue with ipcs command and locales +# +Patch1: rkhunter-1.4.2-ipcs-locale.patch BuildArch: noarch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -31,6 +35,7 @@ and other unwanted tools. %setup -q %patch0 -p1 +%patch1 -p1 %{__cat} <<'EOF' >%{name}.logrotate %{_localstatedir}/log/%{name}/%{name}.log { @@ -99,6 +104,10 @@ EOF %{_mandir}/man8/* %changelog +* Sun Apr 06 2014 Kevin Fenzi 1.4.2-2 +- Add patch to fix ipcs command in non en locales +- Add config to fix freeipa installs. Fixes bug #994567 + * Fri Mar 14 2014 Kevin Fenzi 1.4.2-1 - Update to 1.4.2 @@ -289,7 +298,7 @@ EOF - Changed to SHA1 for optional message digest (canary check) - Added a couple of suggested skip entries to rkhunter.conf -* Mon Jun 11 2005 Greg Houlette - 1.2.7-1 +* Sat Jun 11 2005 Greg Houlette - 1.2.7-1 - Added signature auto-updating to CRON scan (new script) - Removed BOOTSCAN pending rewrite to full SysV Init scan in background - Added the --append-log command line option From 0396062a2fd45171014a6fa5b4ba036d04546f6a Mon Sep 17 00:00:00 2001 From: Dennis Gilmore Date: Sat, 7 Jun 2014 21:36:46 -0500 Subject: [PATCH 02/54] - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index e4a1e6e..b956418 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -104,6 +104,9 @@ EOF %{_mandir}/man8/* %changelog +* Sun Jun 08 2014 Fedora Release Engineering - 1.4.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + * Sun Apr 06 2014 Kevin Fenzi 1.4.2-2 - Add patch to fix ipcs command in non en locales - Add config to fix freeipa installs. Fixes bug #994567 From 750e7c26afe924940e76a862812d0c53b004dab2 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 26 Sep 2014 12:16:45 -0600 Subject: [PATCH 03/54] Fix cron script to work with non bash shells. Fixes bug #1146717 --- 01-rkhunter | 2 +- rkhunter.spec | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/01-rkhunter b/01-rkhunter index 6ff8877..1e85c8e 100755 --- a/01-rkhunter +++ b/01-rkhunter @@ -19,7 +19,7 @@ if [ ! -e /var/lock/subsys/rkhunter ]; then fi # If a diagnostic mode scan was requested, setup the parameters - if [ "$DIAG_SCAN" == "yes" ]; then + if [ "$DIAG_SCAN" = "yes" ]; then RKHUNTER_FLAGS="--checkall --skip-keypress --nocolors --quiet --appendlog --display-logfile" else RKHUNTER_FLAGS="--cronjob --nocolors --report-warnings-only" diff --git a/rkhunter.spec b/rkhunter.spec index b956418..a229e8a 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.2 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -104,6 +104,9 @@ EOF %{_mandir}/man8/* %changelog +* Fri Sep 26 2014 Kevin Fenzi 1.4.2-4 +- Fix cron script to work with non bash shells. Fixes bug #1146717 + * Sun Jun 08 2014 Fedora Release Engineering - 1.4.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild From eff4162c7d39be0bce4ee7d70c2954795ac03dc7 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 27 Oct 2014 09:42:30 -0600 Subject: [PATCH 04/54] Set /var/lib/rkhunter to be mode 700. fixes bug #1154428 --- rkhunter.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index a229e8a..af060e0 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.2 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -56,6 +56,7 @@ EOF %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_pkgdocdir} %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8 +%{__mkdir} -m700 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name} %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/log/%{name} %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n @@ -104,6 +105,9 @@ EOF %{_mandir}/man8/* %changelog +* Mon Oct 27 2014 Kevin Fenzi 1.4.2-5 +- Set /var/lib/rkhunter to be mode 700. fixes bug #1154428 + * Fri Sep 26 2014 Kevin Fenzi 1.4.2-4 - Fix cron script to work with non bash shells. Fixes bug #1146717 From ccad0c6353f09448edd2d7acb7a8f545095bbef0 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 20 Dec 2014 09:13:26 -0700 Subject: [PATCH 05/54] =?UTF-8?q?-=20Add=20/etc/.updated=20systemd=20file?= =?UTF-8?q?=20to=20whitelist.=20Fixes=20bug=20#1173481=20-=20Add=20patch?= =?UTF-8?q?=20to=20fix=20grep=20-a=20issue=20with=20too=20many=20arguments?= =?UTF-8?q?=20output.=C2=B7?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- rkhunter-1.4.2-fedoraconfig.patch | 12 +++++++----- rkhunter-1.4.2-grepopt.patch | 11 +++++++++++ rkhunter.spec | 11 ++++++++++- 3 files changed, 28 insertions(+), 6 deletions(-) create mode 100644 rkhunter-1.4.2-grepopt.patch diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch index 2117d1b..8c06708 100644 --- a/rkhunter-1.4.2-fedoraconfig.patch +++ b/rkhunter-1.4.2-fedoraconfig.patch @@ -1,6 +1,6 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf --- rkhunter-1.4.2.orig/files/rkhunter.conf 2014-01-25 14:29:51.000000000 -0700 -+++ rkhunter-1.4.2/files/rkhunter.conf 2014-04-06 11:43:15.719800756 -0600 ++++ rkhunter-1.4.2/files/rkhunter.conf 2014-12-20 09:06:10.548766864 -0700 @@ -155,6 +155,7 @@ # default directory beneath the installation directory. # @@ -125,7 +125,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # Allow the specified hidden file to be whitelisted. -@@ -620,6 +654,30 @@ +@@ -620,6 +654,32 @@ #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac @@ -153,10 +153,12 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. +ALLOWHIDDENFILE=/etc/.etckeeper +ALLOWHIDDENFILE=/etc/.gitignore +ALLOWHIDDENFILE=/etc/.bzrignore ++# systemd ++ALLOWHIDDENFILE=/etc/.updated # # Allow the specified process to use deleted files. The process name may be -@@ -681,6 +739,18 @@ +@@ -681,6 +741,18 @@ # #ALLOWDEVFILE=/dev/shm/pulse-shm-* #ALLOWDEVFILE=/dev/shm/sem.ADBE_* @@ -175,7 +177,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # This option is used to indicate if the Phalanx2 test is to perform a basic -@@ -1004,6 +1074,11 @@ +@@ -1004,6 +1076,11 @@ # #RTKT_DIR_WHITELIST="" #RTKT_FILE_WHITELIST="" @@ -187,7 +189,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # The following option can be used to whitelist shared library files that would -@@ -1222,3 +1297,5 @@ +@@ -1222,3 +1299,5 @@ # #EMPTY_LOGFILES="" #MISSING_LOGFILES="" diff --git a/rkhunter-1.4.2-grepopt.patch b/rkhunter-1.4.2-grepopt.patch new file mode 100644 index 0000000..6f1f6fb --- /dev/null +++ b/rkhunter-1.4.2-grepopt.patch @@ -0,0 +1,11 @@ +diff -Nur rkhunter-1.4.2.orig/files/rkhunter rkhunter-1.4.2/files/rkhunter +--- rkhunter-1.4.2.orig/files/rkhunter 2014-12-20 09:07:54.826773450 -0700 ++++ rkhunter-1.4.2/files/rkhunter 2014-12-20 09:08:45.739800180 -0700 +@@ -18480,6 +18480,7 @@ + case "${OPERATING_SYSTEM}" in + Linux) + LINUXOS=1 ++ GREP_OPT="-a" + ;; + *BSD|DragonFly) + BSDOS=1 diff --git a/rkhunter.spec b/rkhunter.spec index af060e0..8ae8076 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.2 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -17,6 +17,10 @@ Patch0: rkhunter-1.4.2-fedoraconfig.patch # Fix issue with ipcs command and locales # Patch1: rkhunter-1.4.2-ipcs-locale.patch +# +# Fix grep -a issue +# +Patch2: rkhunter-1.4.2-grepopt.patch BuildArch: noarch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) @@ -36,6 +40,7 @@ and other unwanted tools. %patch0 -p1 %patch1 -p1 +%patch2 -p1 %{__cat} <<'EOF' >%{name}.logrotate %{_localstatedir}/log/%{name}/%{name}.log { @@ -105,6 +110,10 @@ EOF %{_mandir}/man8/* %changelog +* Sat Dec 20 2014 Kevin Fenzi 1.4.2-6 +- Add /etc/.updated systemd file to whitelist. Fixes bug #1173481 +- Add patch to fix grep -a issue with too many arguments output. + * Mon Oct 27 2014 Kevin Fenzi 1.4.2-5 - Set /var/lib/rkhunter to be mode 700. fixes bug #1154428 From ad2d3480decc5c86fd43eadee633a0b4a86b543a Mon Sep 17 00:00:00 2001 From: Dennis Gilmore Date: Thu, 18 Jun 2015 22:24:48 +0000 Subject: [PATCH 06/54] - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 8ae8076..598dcff 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.2 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -110,6 +110,9 @@ EOF %{_mandir}/man8/* %changelog +* Thu Jun 18 2015 Fedora Release Engineering - 1.4.2-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + * Sat Dec 20 2014 Kevin Fenzi 1.4.2-6 - Add /etc/.updated systemd file to whitelist. Fixes bug #1173481 - Add patch to fix grep -a issue with too many arguments output. From 459190292ea13f683a72102740ab05adf32e7c8f Mon Sep 17 00:00:00 2001 From: Mukundan Ragavan Date: Tue, 13 Oct 2015 20:17:51 -0400 Subject: [PATCH 07/54] Change config patch to account for change in default SSH config --- rkhunter-1.4.2-fedoraconfig.patch | 2 +- rkhunter.spec | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch index 8c06708..1aff04a 100644 --- a/rkhunter-1.4.2-fedoraconfig.patch +++ b/rkhunter-1.4.2-fedoraconfig.patch @@ -47,7 +47,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # The default value is 'no'. # #ALLOW_SSH_ROOT_USER=no -+ALLOW_SSH_ROOT_USER=unset ++ALLOW_SSH_ROOT_USER=yes # # Set this option to '1' to allow the use of the SSH-1 protocol, but note diff --git a/rkhunter.spec b/rkhunter.spec index 598dcff..1771b99 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.2 -Release: 7%{?dist} +Release: 8%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -110,6 +110,9 @@ EOF %{_mandir}/man8/* %changelog +* Tue Oct 13 2015 Mukundan Ragavan - 1.4.2-8 +- Change config patch to account for change in default SSH config + * Thu Jun 18 2015 Fedora Release Engineering - 1.4.2-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild From 54e01c542bc3672f30eed07d215ebbd11ea05741 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 6 Dec 2015 11:23:29 -0700 Subject: [PATCH 08/54] Add /dev/shm/squid files to whitelist. Fixes bug #1279632 --- rkhunter-1.4.2-fedoraconfig.patch | 10 ++++++---- rkhunter.spec | 5 ++++- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch index 1aff04a..3df13ef 100644 --- a/rkhunter-1.4.2-fedoraconfig.patch +++ b/rkhunter-1.4.2-fedoraconfig.patch @@ -1,6 +1,6 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf --- rkhunter-1.4.2.orig/files/rkhunter.conf 2014-01-25 14:29:51.000000000 -0700 -+++ rkhunter-1.4.2/files/rkhunter.conf 2014-12-20 09:06:10.548766864 -0700 ++++ rkhunter-1.4.2/files/rkhunter.conf 2015-12-06 11:19:26.840917848 -0700 @@ -155,6 +155,7 @@ # default directory beneath the installation directory. # @@ -158,7 +158,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # Allow the specified process to use deleted files. The process name may be -@@ -681,6 +741,18 @@ +@@ -681,6 +741,20 @@ # #ALLOWDEVFILE=/dev/shm/pulse-shm-* #ALLOWDEVFILE=/dev/shm/sem.ADBE_* @@ -174,10 +174,12 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. +ALLOWDEVFILE="/dev/md/autorebuild.pid" +# 389 Directory Server +ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats ++# squid proxy ++ALLOWDEVFILE=/dev/shm/squid-cf* # # This option is used to indicate if the Phalanx2 test is to perform a basic -@@ -1004,6 +1076,11 @@ +@@ -1004,6 +1078,11 @@ # #RTKT_DIR_WHITELIST="" #RTKT_FILE_WHITELIST="" @@ -189,7 +191,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # The following option can be used to whitelist shared library files that would -@@ -1222,3 +1299,5 @@ +@@ -1222,3 +1301,5 @@ # #EMPTY_LOGFILES="" #MISSING_LOGFILES="" diff --git a/rkhunter.spec b/rkhunter.spec index 1771b99..5ffb7c7 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.2 -Release: 8%{?dist} +Release: 9%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -110,6 +110,9 @@ EOF %{_mandir}/man8/* %changelog +* Sun Dec 06 2015 Kevin Fenzi - 1.4.2-9 +- Add /dev/shm/squid files to whitelist. Fixes bug #1279632 + * Tue Oct 13 2015 Mukundan Ragavan - 1.4.2-8 - Change config patch to account for change in default SSH config From 8e4da676d12c3706862f807fd83beae0421004c1 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 4 Feb 2016 22:12:52 +0000 Subject: [PATCH 09/54] - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 5ffb7c7..a9a647b 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.2 -Release: 9%{?dist} +Release: 10%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -110,6 +110,9 @@ EOF %{_mandir}/man8/* %changelog +* Thu Feb 04 2016 Fedora Release Engineering - 1.4.2-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + * Sun Dec 06 2015 Kevin Fenzi - 1.4.2-9 - Add /dev/shm/squid files to whitelist. Fixes bug #1279632 From a1a79a3b7e493700e4ad72967877ddce4be5a2e8 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Wed, 20 Apr 2016 09:56:26 -0600 Subject: [PATCH 10/54] Add /dev/shm/lldpad files to whitelist. Fixes bug #1293059 --- rkhunter-1.4.2-fedoraconfig.patch | 10 ++++++---- rkhunter.spec | 5 ++++- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch index 3df13ef..e3fa72d 100644 --- a/rkhunter-1.4.2-fedoraconfig.patch +++ b/rkhunter-1.4.2-fedoraconfig.patch @@ -1,6 +1,6 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf --- rkhunter-1.4.2.orig/files/rkhunter.conf 2014-01-25 14:29:51.000000000 -0700 -+++ rkhunter-1.4.2/files/rkhunter.conf 2015-12-06 11:19:26.840917848 -0700 ++++ rkhunter-1.4.2/files/rkhunter.conf 2016-04-20 09:43:32.059538092 -0600 @@ -155,6 +155,7 @@ # default directory beneath the installation directory. # @@ -158,7 +158,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # Allow the specified process to use deleted files. The process name may be -@@ -681,6 +741,20 @@ +@@ -681,6 +741,22 @@ # #ALLOWDEVFILE=/dev/shm/pulse-shm-* #ALLOWDEVFILE=/dev/shm/sem.ADBE_* @@ -176,10 +176,12 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. +ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats +# squid proxy +ALLOWDEVFILE=/dev/shm/squid-cf* ++# allow lldpad state file ++ALLOWDEVFILE=/dev/shm/lldpad.state # # This option is used to indicate if the Phalanx2 test is to perform a basic -@@ -1004,6 +1078,11 @@ +@@ -1004,6 +1080,11 @@ # #RTKT_DIR_WHITELIST="" #RTKT_FILE_WHITELIST="" @@ -191,7 +193,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # The following option can be used to whitelist shared library files that would -@@ -1222,3 +1301,5 @@ +@@ -1222,3 +1303,5 @@ # #EMPTY_LOGFILES="" #MISSING_LOGFILES="" diff --git a/rkhunter.spec b/rkhunter.spec index a9a647b..fd417b0 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.2 -Release: 10%{?dist} +Release: 11%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -110,6 +110,9 @@ EOF %{_mandir}/man8/* %changelog +* Wed Apr 20 2016 Kevin Fenzi - 1.4.2-11 +- Add /dev/shm/lldpad files to whitelist. Fixes bug #1293059 + * Thu Feb 04 2016 Fedora Release Engineering - 1.4.2-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild From d52773e606044a1875b820d90315204b240499e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Fri, 24 Jun 2016 10:20:10 +0200 Subject: [PATCH 11/54] Mandatory Perl build-requires added --- rkhunter.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/rkhunter.spec b/rkhunter.spec index fd417b0..3a88ef4 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -23,6 +23,7 @@ Patch1: rkhunter-1.4.2-ipcs-locale.patch Patch2: rkhunter-1.4.2-grepopt.patch BuildArch: noarch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +BuildRequires: perl-generators Requires: coreutils, binutils, kmod, findutils, grep Requires: e2fsprogs, procps, lsof, iproute, wget From a9f29504934919cedf2df6b864a51f6e1e594648 Mon Sep 17 00:00:00 2001 From: Mukundan Ragavan Date: Wed, 25 Jan 2017 21:11:04 -0500 Subject: [PATCH 12/54] Add /dev/shm/qb* files to whitelist. Fixes bug #1403602 Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug #1411130 --- rkhunter-1.4.2-fedoraconfig.patch | 28 +++++++++++++++++++++------- rkhunter.spec | 6 +++++- 2 files changed, 26 insertions(+), 8 deletions(-) diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch index e3fa72d..9b86c3d 100644 --- a/rkhunter-1.4.2-fedoraconfig.patch +++ b/rkhunter-1.4.2-fedoraconfig.patch @@ -1,6 +1,5 @@ -diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf ---- rkhunter-1.4.2.orig/files/rkhunter.conf 2014-01-25 14:29:51.000000000 -0700 -+++ rkhunter-1.4.2/files/rkhunter.conf 2016-04-20 09:43:32.059538092 -0600 +--- rkhunter-1.4.2.orig/files/rkhunter.conf 2017-01-25 21:03:14.142522097 -0500 ++++ rkhunter-1.4.2/files/rkhunter.conf 2017-01-25 21:05:50.114146953 -0500 @@ -155,6 +155,7 @@ # default directory beneath the installation directory. # @@ -125,7 +124,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # Allow the specified hidden file to be whitelisted. -@@ -620,6 +654,32 @@ +@@ -620,6 +654,45 @@ #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac @@ -155,10 +154,23 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. +ALLOWHIDDENFILE=/etc/.bzrignore +# systemd +ALLOWHIDDENFILE=/etc/.updated ++ ++ ++# Allow PCS/Pacemaker/Corosync ++ALLOWDEVFILE=/dev/shm/qb-attrd-* ++ALLOWDEVFILE=/dev/shm/qb-cfg-* ++ALLOWDEVFILE=/dev/shm/qb-cib_rw-* ++ALLOWDEVFILE=/dev/shm/qb-cib_shm-* ++ALLOWDEVFILE=/dev/shm/qb-corosync-* ++ALLOWDEVFILE=/dev/shm/qb-cpg-* ++ALLOWDEVFILE=/dev/shm/qb-lrmd-* ++ALLOWDEVFILE=/dev/shm/qb-pengine-* ++ALLOWDEVFILE=/dev/shm/qb-quorum-* ++ALLOWDEVFILE=/dev/shm/qb-stonith-* # # Allow the specified process to use deleted files. The process name may be -@@ -681,6 +741,22 @@ +@@ -681,6 +754,24 @@ # #ALLOWDEVFILE=/dev/shm/pulse-shm-* #ALLOWDEVFILE=/dev/shm/sem.ADBE_* @@ -176,12 +188,14 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. +ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats +# squid proxy +ALLOWDEVFILE=/dev/shm/squid-cf* ++# squid ssl cache ++ALLOWDEVFILE=/dev/shm/squid-ssl_session_cache.shm +# allow lldpad state file +ALLOWDEVFILE=/dev/shm/lldpad.state # # This option is used to indicate if the Phalanx2 test is to perform a basic -@@ -1004,6 +1080,11 @@ +@@ -1004,6 +1095,11 @@ # #RTKT_DIR_WHITELIST="" #RTKT_FILE_WHITELIST="" @@ -193,7 +207,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter. # # The following option can be used to whitelist shared library files that would -@@ -1222,3 +1303,5 @@ +@@ -1222,3 +1318,5 @@ # #EMPTY_LOGFILES="" #MISSING_LOGFILES="" diff --git a/rkhunter.spec b/rkhunter.spec index 3a88ef4..c127f6c 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.2 -Release: 11%{?dist} +Release: 12%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -111,6 +111,10 @@ EOF %{_mandir}/man8/* %changelog +* Wed Jan 25 2017 Mukundan Ragavan - 1.4.2-12 +- Add /dev/shm/qb* files to whitelist. Fixes bug #1403602 +- Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug #1411130 + * Wed Apr 20 2016 Kevin Fenzi - 1.4.2-11 - Add /dev/shm/lldpad files to whitelist. Fixes bug #1293059 From 1abde9b791a8482a530e30d559fdd32d6d533c5c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 11 Feb 2017 11:46:04 +0000 Subject: [PATCH 13/54] - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index c127f6c..a1a2ce8 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.2 -Release: 12%{?dist} +Release: 13%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -111,6 +111,9 @@ EOF %{_mandir}/man8/* %changelog +* Sat Feb 11 2017 Fedora Release Engineering - 1.4.2-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + * Wed Jan 25 2017 Mukundan Ragavan - 1.4.2-12 - Add /dev/shm/qb* files to whitelist. Fixes bug #1403602 - Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug #1411130 From 6a0737b2c494a7bf39fb62864f490d2308b51aee Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Fri, 30 Jun 2017 15:06:00 -0600 Subject: [PATCH 14/54] - Update to 1.4.4. Fixes bug #1466318 - Fix for logger and spaces. Fixes bug #1284403 --- .gitignore | 1 + rkhunter-1.4.2-grepopt.patch | 11 --- rkhunter-1.4.2-ipcs-locale.patch | 18 ----- ...patch => rkhunter-1.4.4-fedoraconfig.patch | 74 +++++++++---------- rkhunter.spec | 25 ++----- sources | 2 +- 6 files changed, 46 insertions(+), 85 deletions(-) delete mode 100644 rkhunter-1.4.2-grepopt.patch delete mode 100644 rkhunter-1.4.2-ipcs-locale.patch rename rkhunter-1.4.2-fedoraconfig.patch => rkhunter-1.4.4-fedoraconfig.patch (88%) diff --git a/.gitignore b/.gitignore index 8ffe1c8..1422757 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ rkhunter-1.3.6.tar.gz /rkhunter-1.3.8.tar.gz /rkhunter-1.4.0.tar.gz /rkhunter-1.4.2.tar.gz +/rkhunter-1.4.4.tar.gz diff --git a/rkhunter-1.4.2-grepopt.patch b/rkhunter-1.4.2-grepopt.patch deleted file mode 100644 index 6f1f6fb..0000000 --- a/rkhunter-1.4.2-grepopt.patch +++ /dev/null @@ -1,11 +0,0 @@ -diff -Nur rkhunter-1.4.2.orig/files/rkhunter rkhunter-1.4.2/files/rkhunter ---- rkhunter-1.4.2.orig/files/rkhunter 2014-12-20 09:07:54.826773450 -0700 -+++ rkhunter-1.4.2/files/rkhunter 2014-12-20 09:08:45.739800180 -0700 -@@ -18480,6 +18480,7 @@ - case "${OPERATING_SYSTEM}" in - Linux) - LINUXOS=1 -+ GREP_OPT="-a" - ;; - *BSD|DragonFly) - BSDOS=1 diff --git a/rkhunter-1.4.2-ipcs-locale.patch b/rkhunter-1.4.2-ipcs-locale.patch deleted file mode 100644 index 0457e4c..0000000 --- a/rkhunter-1.4.2-ipcs-locale.patch +++ /dev/null @@ -1,18 +0,0 @@ -diff -Nur rkhunter-1.4.2.orig/files/rkhunter rkhunter-1.4.2/files/rkhunter ---- rkhunter-1.4.2.orig/files/rkhunter 2014-03-12 14:54:55.000000000 -0600 -+++ rkhunter-1.4.2/files/rkhunter 2014-04-06 11:39:44.776583858 -0600 -@@ -13964,11 +13964,11 @@ - touch "${IPCS_TMPFILE}" - FOUND=0; echo $FOUND > "${IPCS_TMPFILE}" - -- if [ `${IPCS_CMD} -u 2>/dev/null | awk -F' ' '/segments allocated/ {print $3}'` -ne 0 ]; then -- ${IPCS_CMD} -m | grep "^0x" | while read RKH_SHM_KEY RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_PERMS RKH_SHM_BYTES RKH_SHM_NATTACH RKH_SHM_STATUS; do -+ if [ `LC_ALL=C ${IPCS_CMD} -u 2>/dev/null | awk -F' ' '/segments allocated/ {print $3}'` -ne 0 ]; then -+ LC_ALL=C ${IPCS_CMD} -m | grep "^0x" | while read RKH_SHM_KEY RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_PERMS RKH_SHM_BYTES RKH_SHM_NATTACH RKH_SHM_STATUS; do - if [ $RKH_SHM_PERMS -eq 666 -a $RKH_SHM_BYTES -ge 1000000 ]; then - FOUND=1; echo $FOUND > "${IPCS_TMPFILE}" -- ${IPCS_CMD} -p | grep "^${RKH_SHM_SHMID}" | while read RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_CPID RKH_SHM_LPID; do -+ LC_ALL=C ${IPCS_CMD} -p | grep "^${RKH_SHM_SHMID}" | while read RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_CPID RKH_SHM_LPID; do - RKH_SHM_PATH=`${READLINK_CMD} -f /proc/${RKH_SHM_CPID}/exe` - if [ $VERBOSE_LOGGING -eq 1 ]; then - display --to LOG --type PLAIN --result FOUND --log-indent 2 ROOTKIT_MALWARE_IPCS_DETAILS "${RKH_SHM_PATH}" "${RKH_SHM_CPID}" "${RKH_SHM_OWNER}" diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.4-fedoraconfig.patch similarity index 88% rename from rkhunter-1.4.2-fedoraconfig.patch rename to rkhunter-1.4.4-fedoraconfig.patch index 9b86c3d..ca26113 100644 --- a/rkhunter-1.4.2-fedoraconfig.patch +++ b/rkhunter-1.4.4-fedoraconfig.patch @@ -1,6 +1,7 @@ ---- rkhunter-1.4.2.orig/files/rkhunter.conf 2017-01-25 21:03:14.142522097 -0500 -+++ rkhunter-1.4.2/files/rkhunter.conf 2017-01-25 21:05:50.114146953 -0500 -@@ -155,6 +155,7 @@ +diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.conf +--- rkhunter-1.4.4.orig/files/rkhunter.conf 2017-06-22 18:19:20.000000000 -0600 ++++ rkhunter-1.4.4/files/rkhunter.conf 2017-06-30 14:45:05.104227416 -0600 +@@ -158,6 +158,7 @@ # default directory beneath the installation directory. # #TMPDIR=/var/lib/rkhunter/tmp @@ -8,16 +9,15 @@ # # This option specifies the database directory to use. -@@ -163,7 +164,7 @@ - # subsequently commented out or removed, then the program will assume a +@@ -167,6 +168,7 @@ # default directory beneath the installation directory. # --#DBDIR=/var/lib/rkhunter/db + #DBDIR=/var/lib/rkhunter/db +DBDIR=/var/lib/rkhunter/db # # This option specifies the script directory to use. -@@ -172,6 +173,7 @@ +@@ -175,6 +177,7 @@ # subsequently commented out or removed, then the program will not run. # #SCRIPTDIR=/usr/local/lib/rkhunter/scripts @@ -25,7 +25,7 @@ # # This option can be used to modify the command directory list used by rkhunter -@@ -228,7 +230,7 @@ +@@ -231,7 +234,7 @@ # # The default value is '/var/log/rkhunter.log'. # @@ -34,7 +34,7 @@ # # Set this option to '1' if the log file is to be appended to whenever rkhunter -@@ -238,6 +240,7 @@ +@@ -241,6 +244,7 @@ # The default value is '0'. # #APPEND_LOG=0 @@ -42,7 +42,7 @@ # # Set the following option to '1' if the log file is to be copied when rkhunter -@@ -304,6 +307,7 @@ +@@ -307,6 +311,7 @@ # The default value is 'no'. # #ALLOW_SSH_ROOT_USER=no @@ -50,7 +50,7 @@ # # Set this option to '1' to allow the use of the SSH-1 protocol, but note -@@ -318,6 +322,7 @@ +@@ -321,6 +326,7 @@ # The default value is '0'. # #ALLOW_SSH_PROT_V1=0 @@ -58,17 +58,17 @@ # # This setting tells rkhunter the directory containing the SSH configuration -@@ -350,7 +355,8 @@ +@@ -353,7 +359,8 @@ # program defaults. # ENABLE_TESTS=ALL --DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps -+#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps +-DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps ++#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps +DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps # # The HASH_CMD option can be used to specify the command to use for the file -@@ -422,6 +428,7 @@ +@@ -434,6 +441,7 @@ # Also see the PKGMGR_NO_VRFY and USE_SUNSUM options. # #PKGMGR=NONE @@ -76,7 +76,7 @@ # # It is possible that a file, which is part of a package, may have been -@@ -545,6 +552,14 @@ +@@ -557,6 +565,14 @@ # The default value is the null string. # #EXISTWHITELIST="" @@ -91,7 +91,7 @@ # # Whitelist various attributes of the specified file. The attributes are those -@@ -575,6 +590,12 @@ +@@ -587,6 +603,12 @@ # The default value is the null string. # #SCRIPTWHITELIST=/usr/bin/groups @@ -104,7 +104,7 @@ # # Allow the specified file to have the immutable attribute set. -@@ -605,6 +626,19 @@ +@@ -617,6 +639,19 @@ #ALLOWHIDDENDIR=/dev/.udev #ALLOWHIDDENDIR=/dev/.udevdb #ALLOWHIDDENDIR=/dev/.mdadm @@ -124,7 +124,7 @@ # # Allow the specified hidden file to be whitelisted. -@@ -620,6 +654,45 @@ +@@ -632,6 +667,32 @@ #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac @@ -154,23 +154,10 @@ +ALLOWHIDDENFILE=/etc/.bzrignore +# systemd +ALLOWHIDDENFILE=/etc/.updated -+ -+ -+# Allow PCS/Pacemaker/Corosync -+ALLOWDEVFILE=/dev/shm/qb-attrd-* -+ALLOWDEVFILE=/dev/shm/qb-cfg-* -+ALLOWDEVFILE=/dev/shm/qb-cib_rw-* -+ALLOWDEVFILE=/dev/shm/qb-cib_shm-* -+ALLOWDEVFILE=/dev/shm/qb-corosync-* -+ALLOWDEVFILE=/dev/shm/qb-cpg-* -+ALLOWDEVFILE=/dev/shm/qb-lrmd-* -+ALLOWDEVFILE=/dev/shm/qb-pengine-* -+ALLOWDEVFILE=/dev/shm/qb-quorum-* -+ALLOWDEVFILE=/dev/shm/qb-stonith-* # # Allow the specified process to use deleted files. The process name may be -@@ -681,6 +754,24 @@ +@@ -701,6 +762,35 @@ # #ALLOWDEVFILE=/dev/shm/pulse-shm-* #ALLOWDEVFILE=/dev/shm/sem.ADBE_* @@ -192,10 +179,21 @@ +ALLOWDEVFILE=/dev/shm/squid-ssl_session_cache.shm +# allow lldpad state file +ALLOWDEVFILE=/dev/shm/lldpad.state ++# Allow PCS/Pacemaker/Corosync ++ALLOWDEVFILE=/dev/shm/qb-attrd-* ++ALLOWDEVFILE=/dev/shm/qb-cfg-* ++ALLOWDEVFILE=/dev/shm/qb-cib_rw-* ++ALLOWDEVFILE=/dev/shm/qb-cib_shm-* ++ALLOWDEVFILE=/dev/shm/qb-corosync-* ++ALLOWDEVFILE=/dev/shm/qb-cpg-* ++ALLOWDEVFILE=/dev/shm/qb-lrmd-* ++ALLOWDEVFILE=/dev/shm/qb-pengine-* ++ALLOWDEVFILE=/dev/shm/qb-quorum-* ++ALLOWDEVFILE=/dev/shm/qb-stonith-* # - # This option is used to indicate if the Phalanx2 test is to perform a basic -@@ -1004,6 +1095,11 @@ + # Allow the specified process pathnames to use shared memory segments. +@@ -1035,6 +1125,11 @@ # #RTKT_DIR_WHITELIST="" #RTKT_FILE_WHITELIST="" @@ -207,9 +205,9 @@ # # The following option can be used to whitelist shared library files that would -@@ -1222,3 +1318,5 @@ +@@ -1274,3 +1369,5 @@ + # The default value is '0'. # - #EMPTY_LOGFILES="" - #MISSING_LOGFILES="" + #GLOBSTAR=0 + +INSTALLDIR="/usr" diff --git a/rkhunter.spec b/rkhunter.spec index a1a2ce8..9b3d533 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -2,8 +2,8 @@ %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}} Name: rkhunter -Version: 1.4.2 -Release: 13%{?dist} +Version: 1.4.4 +Release: 1%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -12,17 +12,8 @@ URL: http://rkhunter.sourceforge.net/ Source0: http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz Source2: 01-rkhunter Source3: rkhunter.sysconfig -Patch0: rkhunter-1.4.2-fedoraconfig.patch -# -# Fix issue with ipcs command and locales -# -Patch1: rkhunter-1.4.2-ipcs-locale.patch -# -# Fix grep -a issue -# -Patch2: rkhunter-1.4.2-grepopt.patch +Patch0: rkhunter-1.4.4-fedoraconfig.patch BuildArch: noarch -BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: perl-generators Requires: coreutils, binutils, kmod, findutils, grep @@ -37,11 +28,7 @@ and other unwanted tools. %prep -%setup -q - -%patch0 -p1 -%patch1 -p1 -%patch2 -p1 +%autosetup -p1 %{__cat} <<'EOF' >%{name}.logrotate %{_localstatedir}/log/%{name}/%{name}.log { @@ -111,6 +98,10 @@ EOF %{_mandir}/man8/* %changelog +* Thu Jun 29 2017 Kevin Fenzi - 1.4.4-1 +- Update to 1.4.4. Fixes bug #1466318 +- Fix for logger and spaces. Fixes bug #1284403 + * Sat Feb 11 2017 Fedora Release Engineering - 1.4.2-13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild diff --git a/sources b/sources index 873ec5b..458900a 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -85ad366b7f3999eb2a9371e39a1a4df7 rkhunter-1.4.2.tar.gz +SHA512 (rkhunter-1.4.4.tar.gz) = 87e9c617220765678cc4519eee27d1d56185c3a7fb1d6338c8fb984ac4f5176c31bb54b69e1de615d66a0cf1e72b672e66b368e37851a459def69463cbb8661e From 92139827131e2d87e80903a333a8a98bb80d3936 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Thu, 13 Jul 2017 10:55:19 +0200 Subject: [PATCH 15/54] perl dependency renamed to perl-interpreter --- rkhunter.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/rkhunter.spec b/rkhunter.spec index 9b3d533..2f66095 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.4 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -18,7 +18,7 @@ BuildRequires: perl-generators Requires: coreutils, binutils, kmod, findutils, grep Requires: e2fsprogs, procps, lsof, iproute, wget -Requires: perl, perl(strict), perl(IO::Socket), mailx, logrotate +Requires: perl-interpreter, perl(strict), perl(IO::Socket), mailx, logrotate Requires: crontabs %description @@ -98,6 +98,10 @@ EOF %{_mandir}/man8/* %changelog +* Thu Jul 13 2017 Petr Pisar - 1.4.4-2 +- perl dependency renamed to perl-interpreter + + * Thu Jun 29 2017 Kevin Fenzi - 1.4.4-1 - Update to 1.4.4. Fixes bug #1466318 - Fix for logger and spaces. Fixes bug #1284403 From 9ce2db8216f8e379c7546fea41bf07b4450130de Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 27 Jul 2017 13:11:28 +0000 Subject: [PATCH 16/54] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 2f66095..ecc95e6 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.4 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -98,6 +98,9 @@ EOF %{_mandir}/man8/* %changelog +* Thu Jul 27 2017 Fedora Release Engineering - 1.4.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + * Thu Jul 13 2017 Petr Pisar - 1.4.4-2 - perl dependency renamed to perl-interpreter From f7a7db4c59930f0b99784054a30ff7e60305ef2e Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 12 Aug 2017 12:21:12 -0700 Subject: [PATCH 17/54] Disable ipc_shared_mem test for now due to false positives. Bug #1472299 --- rkhunter-1.4.4-fedoraconfig.patch | 6 +++--- rkhunter.spec | 5 ++++- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/rkhunter-1.4.4-fedoraconfig.patch b/rkhunter-1.4.4-fedoraconfig.patch index ca26113..8f0a83c 100644 --- a/rkhunter-1.4.4-fedoraconfig.patch +++ b/rkhunter-1.4.4-fedoraconfig.patch @@ -1,6 +1,6 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.conf ---- rkhunter-1.4.4.orig/files/rkhunter.conf 2017-06-22 18:19:20.000000000 -0600 -+++ rkhunter-1.4.4/files/rkhunter.conf 2017-06-30 14:45:05.104227416 -0600 +--- rkhunter-1.4.4.orig/files/rkhunter.conf 2017-06-22 17:19:20.000000000 -0700 ++++ rkhunter-1.4.4/files/rkhunter.conf 2017-08-12 12:17:45.955313658 -0700 @@ -158,6 +158,7 @@ # default directory beneath the installation directory. # @@ -64,7 +64,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter. ENABLE_TESTS=ALL -DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps +#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps -+DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps ++DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps ipc_shared_mem # # The HASH_CMD option can be used to specify the command to use for the file diff --git a/rkhunter.spec b/rkhunter.spec index ecc95e6..daa8b26 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.4 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -98,6 +98,9 @@ EOF %{_mandir}/man8/* %changelog +* Sat Aug 12 2017 Kevin Fenzi - 1.4.4-4 +- Disable ipc_shared_mem test for now due to false positives. Bug #1472299 + * Thu Jul 27 2017 Fedora Release Engineering - 1.4.4-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild From 287a60a4afc5f8aac82b33ee7203dff9dd6bb225 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Mon, 27 Nov 2017 18:29:27 -0800 Subject: [PATCH 18/54] Add fix for new rpm queryformat and ARCH. Fixes bug #1517387 --- rkhunter-1.4.4-rpmqueryformat.patch | 21 +++++++++++++++++++++ rkhunter.spec | 7 ++++++- 2 files changed, 27 insertions(+), 1 deletion(-) create mode 100644 rkhunter-1.4.4-rpmqueryformat.patch diff --git a/rkhunter-1.4.4-rpmqueryformat.patch b/rkhunter-1.4.4-rpmqueryformat.patch new file mode 100644 index 0000000..59b5f8d --- /dev/null +++ b/rkhunter-1.4.4-rpmqueryformat.patch @@ -0,0 +1,21 @@ +diff -Nur rkhunter-1.4.4.orig/files/rkhunter rkhunter-1.4.4/files/rkhunter +--- rkhunter-1.4.4.orig/files/rkhunter 2017-06-29 00:51:57.000000000 -0700 ++++ rkhunter-1.4.4/files/rkhunter 2017-11-27 18:10:04.027860499 -0800 +@@ -6437,7 +6437,7 @@ + FILE_IS_PKGD=1 + PKGNAME=`echo "${RKHTMPVAR}" | tail ${TAIL_OPT}1` + +- RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${FNAMEGREP}\$"` ++ RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{=ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${FNAMEGREP}\$"` + ERRCODE=$? + + # +@@ -6453,7 +6453,7 @@ + RKHTMPVAR3="/usr${FNAMEGREP}" + fi + +- RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${RKHTMPVAR3}\$"` ++ RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{=ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${RKHTMPVAR3}\$"` + ERRCODE=$? + fi + diff --git a/rkhunter.spec b/rkhunter.spec index daa8b26..2fb29e9 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.4 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -13,6 +13,8 @@ Source0: http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.ta Source2: 01-rkhunter Source3: rkhunter.sysconfig Patch0: rkhunter-1.4.4-fedoraconfig.patch +# fix queryformat in new rpm. Already upstream, backwards compatible +Patch1: rkhunter-1.4.4-rpmqueryformat.patch BuildArch: noarch BuildRequires: perl-generators @@ -98,6 +100,9 @@ EOF %{_mandir}/man8/* %changelog +* Mon Nov 27 2017 Kevin Fenzi - 1.4.4-5 +- Add fix for new rpm queryformat and ARCH. Fixes bug #1517387 + * Sat Aug 12 2017 Kevin Fenzi - 1.4.4-4 - Disable ipc_shared_mem test for now due to false positives. Bug #1472299 From 72a6e4ea774dbcb54f1b9fd681e5d80c15d1bc16 Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Fri, 9 Feb 2018 09:05:57 +0100 Subject: [PATCH 19/54] Escape macros in %changelog Reference: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/Y2ZUKK2B7T2IKXPMODNF6HB2O5T5TS6H/ Signed-off-by: Igor Gnatenko --- rkhunter.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/rkhunter.spec b/rkhunter.spec index 2fb29e9..2ace918 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.4 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -100,6 +100,9 @@ EOF %{_mandir}/man8/* %changelog +* Fri Feb 09 2018 Igor Gnatenko - 1.4.4-6 +- Escape macros in %%changelog + * Mon Nov 27 2017 Kevin Fenzi - 1.4.4-5 - Add fix for new rpm queryformat and ARCH. Fixes bug #1517387 @@ -207,7 +210,7 @@ EOF - Add /usr/share/man/man5/.k5identity.5.gz to whitelisted hidden files. * Wed Oct 12 2011 Jim Pirzyk - 1.3.8-10 -- Update %files section so that some .dat files are marked %ghost +- Update %%files section so that some .dat files are marked %%ghost * Fri Aug 05 2011 Kevin Fenzi - 1.3.8-9 - Add patch to fix ALLOWPROCDELFILE config option. fixes bug #727524 From a811f64f5646560f68b751ba2d607fa30613010b Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Wed, 14 Feb 2018 09:17:30 +0100 Subject: [PATCH 20/54] Remove %clean section None of currently supported distributions need that. Last one was EL5 which is EOL for a while. Signed-off-by: Igor Gnatenko --- rkhunter.spec | 3 --- 1 file changed, 3 deletions(-) diff --git a/rkhunter.spec b/rkhunter.spec index 2ace918..7dcd862 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -77,9 +77,6 @@ EOF %{__install} -m640 -p files/%{name}.conf ${RPM_BUILD_ROOT}%{_sysconfdir}/ %{__install} -m640 -p %{SOURCE3} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name} -%clean -%{__rm} -rf $RPM_BUILD_ROOT - %files %defattr(-,root,root,-) %doc %{_pkgdocdir}/* From 545c12f7b7e206473f159b33c171ae3ccb9a5817 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 25 Feb 2018 15:12:57 -0800 Subject: [PATCH 21/54] Update to 1.4.6. Fixes bug #1547315 Allow KRA vault log files. Fixes bug #1541472 ipc_shared_mem warning fixed upstream. Fixes bug #1524456 --- rkhunter-1.4.4-rpmqueryformat.patch | 21 ---------------- ...patch => rkhunter-1.4.6-fedoraconfig.patch | 25 +++++++++++-------- rkhunter.spec | 13 ++++++---- 3 files changed, 22 insertions(+), 37 deletions(-) delete mode 100644 rkhunter-1.4.4-rpmqueryformat.patch rename rkhunter-1.4.4-fedoraconfig.patch => rkhunter-1.4.6-fedoraconfig.patch (91%) diff --git a/rkhunter-1.4.4-rpmqueryformat.patch b/rkhunter-1.4.4-rpmqueryformat.patch deleted file mode 100644 index 59b5f8d..0000000 --- a/rkhunter-1.4.4-rpmqueryformat.patch +++ /dev/null @@ -1,21 +0,0 @@ -diff -Nur rkhunter-1.4.4.orig/files/rkhunter rkhunter-1.4.4/files/rkhunter ---- rkhunter-1.4.4.orig/files/rkhunter 2017-06-29 00:51:57.000000000 -0700 -+++ rkhunter-1.4.4/files/rkhunter 2017-11-27 18:10:04.027860499 -0800 -@@ -6437,7 +6437,7 @@ - FILE_IS_PKGD=1 - PKGNAME=`echo "${RKHTMPVAR}" | tail ${TAIL_OPT}1` - -- RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${FNAMEGREP}\$"` -+ RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{=ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${FNAMEGREP}\$"` - ERRCODE=$? - - # -@@ -6453,7 +6453,7 @@ - RKHTMPVAR3="/usr${FNAMEGREP}" - fi - -- RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${RKHTMPVAR3}\$"` -+ RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{=ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${RKHTMPVAR3}\$"` - ERRCODE=$? - fi - diff --git a/rkhunter-1.4.4-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch similarity index 91% rename from rkhunter-1.4.4-fedoraconfig.patch rename to rkhunter-1.4.6-fedoraconfig.patch index 8f0a83c..a93cdd9 100644 --- a/rkhunter-1.4.4-fedoraconfig.patch +++ b/rkhunter-1.4.6-fedoraconfig.patch @@ -1,6 +1,6 @@ -diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.conf ---- rkhunter-1.4.4.orig/files/rkhunter.conf 2017-06-22 17:19:20.000000000 -0700 -+++ rkhunter-1.4.4/files/rkhunter.conf 2017-08-12 12:17:45.955313658 -0700 +diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf +--- rkhunter-1.4.6.orig/files/rkhunter.conf 2018-02-19 15:49:06.000000000 -0800 ++++ rkhunter-1.4.6/files/rkhunter.conf 2018-02-25 15:07:20.766420580 -0800 @@ -158,6 +158,7 @@ # default directory beneath the installation directory. # @@ -68,7 +68,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter. # # The HASH_CMD option can be used to specify the command to use for the file -@@ -434,6 +441,7 @@ +@@ -435,6 +442,7 @@ # Also see the PKGMGR_NO_VRFY and USE_SUNSUM options. # #PKGMGR=NONE @@ -76,7 +76,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter. # # It is possible that a file, which is part of a package, may have been -@@ -557,6 +565,14 @@ +@@ -558,6 +566,17 @@ # The default value is the null string. # #EXISTWHITELIST="" @@ -85,13 +85,16 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter. +EXISTWHITELIST=/var/log/pki-ca/system +# FreeIPA Certificate Authority +EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system ++# FreeIPA with KRA (Password Vault) ++EXISTWHITELIST=/var/log/pki/pki-tomcat/kra/system ++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/kra/system +# Some non default installed files we check +EXISTWHITELIST=/usr/bin/GET +EXISTWHITELIST=/usr/bin/whatis # # Whitelist various attributes of the specified file. The attributes are those -@@ -587,6 +603,12 @@ +@@ -588,6 +607,12 @@ # The default value is the null string. # #SCRIPTWHITELIST=/usr/bin/groups @@ -104,7 +107,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter. # # Allow the specified file to have the immutable attribute set. -@@ -617,6 +639,19 @@ +@@ -630,6 +655,19 @@ #ALLOWHIDDENDIR=/dev/.udev #ALLOWHIDDENDIR=/dev/.udevdb #ALLOWHIDDENDIR=/dev/.mdadm @@ -124,7 +127,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter. # # Allow the specified hidden file to be whitelisted. -@@ -632,6 +667,32 @@ +@@ -645,6 +683,32 @@ #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac @@ -157,7 +160,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter. # # Allow the specified process to use deleted files. The process name may be -@@ -701,6 +762,35 @@ +@@ -714,6 +778,35 @@ # #ALLOWDEVFILE=/dev/shm/pulse-shm-* #ALLOWDEVFILE=/dev/shm/sem.ADBE_* @@ -193,7 +196,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter. # # Allow the specified process pathnames to use shared memory segments. -@@ -1035,6 +1125,11 @@ +@@ -1090,6 +1183,11 @@ # #RTKT_DIR_WHITELIST="" #RTKT_FILE_WHITELIST="" @@ -205,7 +208,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter. # # The following option can be used to whitelist shared library files that would -@@ -1274,3 +1369,5 @@ +@@ -1329,3 +1427,5 @@ # The default value is '0'. # #GLOBSTAR=0 diff --git a/rkhunter.spec b/rkhunter.spec index 7dcd862..5f92a28 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -2,8 +2,8 @@ %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}} Name: rkhunter -Version: 1.4.4 -Release: 6%{?dist} +Version: 1.4.6 +Release: 1%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -12,9 +12,7 @@ URL: http://rkhunter.sourceforge.net/ Source0: http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz Source2: 01-rkhunter Source3: rkhunter.sysconfig -Patch0: rkhunter-1.4.4-fedoraconfig.patch -# fix queryformat in new rpm. Already upstream, backwards compatible -Patch1: rkhunter-1.4.4-rpmqueryformat.patch +Patch0: rkhunter-1.4.6-fedoraconfig.patch BuildArch: noarch BuildRequires: perl-generators @@ -97,6 +95,11 @@ EOF %{_mandir}/man8/* %changelog +* Sun Feb 25 2018 Kevin Fenzi - 1.4.6-1 +- Update to 1.4.6. Fixes bug #1547315 +- Allow KRA vault log files. Fixes bug #1541472 +- ipc_shared_mem warning fixed upstream. Fixes bug #1524456 + * Fri Feb 09 2018 Igor Gnatenko - 1.4.4-6 - Escape macros in %%changelog From a1f61599370b4d34cbee41bf5a560475c31853d4 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 25 Feb 2018 15:36:23 -0800 Subject: [PATCH 22/54] Also add sources --- .gitignore | 1 + sources | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.gitignore b/.gitignore index 1422757..0486fc1 100644 --- a/.gitignore +++ b/.gitignore @@ -3,3 +3,4 @@ rkhunter-1.3.6.tar.gz /rkhunter-1.4.0.tar.gz /rkhunter-1.4.2.tar.gz /rkhunter-1.4.4.tar.gz +/rkhunter-1.4.6.tar.gz diff --git a/sources b/sources index 458900a..956755f 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (rkhunter-1.4.4.tar.gz) = 87e9c617220765678cc4519eee27d1d56185c3a7fb1d6338c8fb984ac4f5176c31bb54b69e1de615d66a0cf1e72b672e66b368e37851a459def69463cbb8661e +SHA512 (rkhunter-1.4.6.tar.gz) = c51a21b6b66ed1f73a19d8ce04eaba35999eefcb666acc824989c3bf53ac56d24a33ac4fec290be942e33fe24674406b371eafff73f7e697b9e03ec031b37216 From c36061be216e25baf935bdb7ad5508b43750d9f8 Mon Sep 17 00:00:00 2001 From: Jason Tibbitts Date: Tue, 10 Jul 2018 01:33:55 -0500 Subject: [PATCH 23/54] Remove needless use of %defattr --- rkhunter.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 5f92a28..5d9e472 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -76,7 +76,6 @@ EOF %{__install} -m640 -p %{SOURCE3} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name} %files -%defattr(-,root,root,-) %doc %{_pkgdocdir}/* %{_bindir}/%{name} %dir %{_datadir}/%{name} From c20f68759374d9a83d85f52ce8b4e6310fd9c519 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 14 Jul 2018 03:38:17 +0000 Subject: [PATCH 24/54] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 5d9e472..b42ae1f 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System @@ -94,6 +94,9 @@ EOF %{_mandir}/man8/* %changelog +* Sat Jul 14 2018 Fedora Release Engineering - 1.4.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + * Sun Feb 25 2018 Kevin Fenzi - 1.4.6-1 - Update to 1.4.6. Fixes bug #1547315 - Allow KRA vault log files. Fixes bug #1541472 From 5d155e09e200135758f86a3f5205943ab1b9767e Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Mon, 28 Jan 2019 20:18:21 +0100 Subject: [PATCH 25/54] Remove obsolete Group tag References: https://fedoraproject.org/wiki/Changes/Remove_Group_Tag --- rkhunter.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index b42ae1f..5c96e3a 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -6,7 +6,6 @@ Version: 1.4.6 Release: 2%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits -Group: Applications/System License: GPLv2+ URL: http://rkhunter.sourceforge.net/ Source0: http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz From 9114393bb4c14b3a0902b84adf1ebef7c29a6143 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 2 Feb 2019 11:26:58 +0000 Subject: [PATCH 26/54] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 5c96e3a..8972e2b 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -93,6 +93,9 @@ EOF %{_mandir}/man8/* %changelog +* Sat Feb 02 2019 Fedora Release Engineering - 1.4.6-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Sat Jul 14 2018 Fedora Release Engineering - 1.4.6-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild From ce2173f1dc39f6976de730638dc09b3005a1ca41 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 14 Apr 2019 16:35:50 -0700 Subject: [PATCH 27/54] Drop ifup/ifdown since network-scripts is now deprecated. Fixes bug #1698920 --- rkhunter-1.4.6-fedoraconfig.patch | 16 +++++++--------- rkhunter.spec | 5 ++++- 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/rkhunter-1.4.6-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch index a93cdd9..4dbc624 100644 --- a/rkhunter-1.4.6-fedoraconfig.patch +++ b/rkhunter-1.4.6-fedoraconfig.patch @@ -1,6 +1,6 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf --- rkhunter-1.4.6.orig/files/rkhunter.conf 2018-02-19 15:49:06.000000000 -0800 -+++ rkhunter-1.4.6/files/rkhunter.conf 2018-02-25 15:07:20.766420580 -0800 ++++ rkhunter-1.4.6/files/rkhunter.conf 2019-04-14 16:30:22.914740071 -0700 @@ -158,6 +158,7 @@ # default directory beneath the installation directory. # @@ -94,7 +94,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. # # Whitelist various attributes of the specified file. The attributes are those -@@ -588,6 +607,12 @@ +@@ -588,6 +607,10 @@ # The default value is the null string. # #SCRIPTWHITELIST=/usr/bin/groups @@ -102,12 +102,10 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. +SCRIPTWHITELIST=/usr/bin/ldd +SCRIPTWHITELIST=/usr/bin/groups +SCRIPTWHITELIST=/usr/bin/GET -+SCRIPTWHITELIST=/sbin/ifup -+SCRIPTWHITELIST=/sbin/ifdown # # Allow the specified file to have the immutable attribute set. -@@ -630,6 +655,19 @@ +@@ -630,6 +653,19 @@ #ALLOWHIDDENDIR=/dev/.udev #ALLOWHIDDENDIR=/dev/.udevdb #ALLOWHIDDENDIR=/dev/.mdadm @@ -127,7 +125,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. # # Allow the specified hidden file to be whitelisted. -@@ -645,6 +683,32 @@ +@@ -645,6 +681,32 @@ #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac @@ -160,7 +158,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. # # Allow the specified process to use deleted files. The process name may be -@@ -714,6 +778,35 @@ +@@ -714,6 +776,35 @@ # #ALLOWDEVFILE=/dev/shm/pulse-shm-* #ALLOWDEVFILE=/dev/shm/sem.ADBE_* @@ -196,7 +194,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. # # Allow the specified process pathnames to use shared memory segments. -@@ -1090,6 +1183,11 @@ +@@ -1090,6 +1181,11 @@ # #RTKT_DIR_WHITELIST="" #RTKT_FILE_WHITELIST="" @@ -208,7 +206,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. # # The following option can be used to whitelist shared library files that would -@@ -1329,3 +1427,5 @@ +@@ -1329,3 +1425,5 @@ # The default value is '0'. # #GLOBSTAR=0 diff --git a/rkhunter.spec b/rkhunter.spec index 8972e2b..93344f3 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -93,6 +93,9 @@ EOF %{_mandir}/man8/* %changelog +* Sun Apr 14 2019 Kevin Fenzi - 1.4.6-4 +- Drop ifup/ifdown since network-scripts is now deprecated. Fixes bug #1698920 + * Sat Feb 02 2019 Fedora Release Engineering - 1.4.6-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild From 36eb0f4abbb063572220bfabf24a2ad4efdb6a15 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 26 Jul 2019 18:37:38 +0000 Subject: [PATCH 28/54] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 93344f3..e627535 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -93,6 +93,9 @@ EOF %{_mandir}/man8/* %changelog +* Fri Jul 26 2019 Fedora Release Engineering - 1.4.6-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Sun Apr 14 2019 Kevin Fenzi - 1.4.6-4 - Drop ifup/ifdown since network-scripts is now deprecated. Fixes bug #1698920 From 5857eb61fa65d8ce2468d6b4c2d3ec474a199082 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 6 Oct 2019 12:39:20 -0700 Subject: [PATCH 29/54] Adjust config for PermitRootLogin change in f31+. Fixes bug #1756593 --- rkhunter-1.4.6-fedoraconfig.patch | 4 ++-- rkhunter.spec | 5 ++++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/rkhunter-1.4.6-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch index 4dbc624..a70a6a7 100644 --- a/rkhunter-1.4.6-fedoraconfig.patch +++ b/rkhunter-1.4.6-fedoraconfig.patch @@ -1,6 +1,6 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf --- rkhunter-1.4.6.orig/files/rkhunter.conf 2018-02-19 15:49:06.000000000 -0800 -+++ rkhunter-1.4.6/files/rkhunter.conf 2019-04-14 16:30:22.914740071 -0700 ++++ rkhunter-1.4.6/files/rkhunter.conf 2019-10-06 12:35:15.519680911 -0700 @@ -158,6 +158,7 @@ # default directory beneath the installation directory. # @@ -46,7 +46,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. # The default value is 'no'. # #ALLOW_SSH_ROOT_USER=no -+ALLOW_SSH_ROOT_USER=yes ++ALLOW_SSH_ROOT_USER=unset # # Set this option to '1' to allow the use of the SSH-1 protocol, but note diff --git a/rkhunter.spec b/rkhunter.spec index e627535..7943cb4 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -93,6 +93,9 @@ EOF %{_mandir}/man8/* %changelog +* Sun Oct 06 2019 Kevin Fenzi - 1.4.6-6 +- Adjust config for PermitRootLogin change in f31+. Fixes bug #1756593 + * Fri Jul 26 2019 Fedora Release Engineering - 1.4.6-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From 5a71981d2ebae6ab9d2f263b1832866b24e9e247 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 30 Jan 2020 17:43:43 +0000 Subject: [PATCH 30/54] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 7943cb4..464a784 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -93,6 +93,9 @@ EOF %{_mandir}/man8/* %changelog +* Thu Jan 30 2020 Fedora Release Engineering - 1.4.6-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + * Sun Oct 06 2019 Kevin Fenzi - 1.4.6-6 - Adjust config for PermitRootLogin change in f31+. Fixes bug #1756593 From 4fceddaadaf4a947d51b9107e5a3eddb19a0c00d Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 16 May 2020 14:00:06 -0700 Subject: [PATCH 31/54] Add allow for podman's /dev/shm files (fixes bug #1828698 ) --- rkhunter-1.4.6-fedoraconfig.patch | 10 ++++++---- rkhunter.spec | 5 ++++- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/rkhunter-1.4.6-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch index a70a6a7..dcb6b07 100644 --- a/rkhunter-1.4.6-fedoraconfig.patch +++ b/rkhunter-1.4.6-fedoraconfig.patch @@ -1,6 +1,6 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf --- rkhunter-1.4.6.orig/files/rkhunter.conf 2018-02-19 15:49:06.000000000 -0800 -+++ rkhunter-1.4.6/files/rkhunter.conf 2019-10-06 12:35:15.519680911 -0700 ++++ rkhunter-1.4.6/files/rkhunter.conf 2020-05-16 13:51:19.431725722 -0700 @@ -158,6 +158,7 @@ # default directory beneath the installation directory. # @@ -158,7 +158,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. # # Allow the specified process to use deleted files. The process name may be -@@ -714,6 +776,35 @@ +@@ -714,6 +776,37 @@ # #ALLOWDEVFILE=/dev/shm/pulse-shm-* #ALLOWDEVFILE=/dev/shm/sem.ADBE_* @@ -191,10 +191,12 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. +ALLOWDEVFILE=/dev/shm/qb-pengine-* +ALLOWDEVFILE=/dev/shm/qb-quorum-* +ALLOWDEVFILE=/dev/shm/qb-stonith-* ++# Allow podman ++ALLOWDEVFILE=/dev/shm/libpod*lock* # # Allow the specified process pathnames to use shared memory segments. -@@ -1090,6 +1181,11 @@ +@@ -1090,6 +1183,11 @@ # #RTKT_DIR_WHITELIST="" #RTKT_FILE_WHITELIST="" @@ -206,7 +208,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. # # The following option can be used to whitelist shared library files that would -@@ -1329,3 +1425,5 @@ +@@ -1329,3 +1427,5 @@ # The default value is '0'. # #GLOBSTAR=0 diff --git a/rkhunter.spec b/rkhunter.spec index 464a784..4322225 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 7%{?dist} +Release: 8%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -93,6 +93,9 @@ EOF %{_mandir}/man8/* %changelog +* Sat May 16 2020 Kevin Fenzi - 1.4.6-8 +- Add allow for podman's /dev/shm files (fixes bug #1828698 ) + * Thu Jan 30 2020 Fedora Release Engineering - 1.4.6-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild From 63afb91cf5695010d60b32458ccccf42339ff3df Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jul 2020 05:48:29 +0000 Subject: [PATCH 32/54] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 4322225..ded9ff1 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 8%{?dist} +Release: 9%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -93,6 +93,9 @@ EOF %{_mandir}/man8/* %changelog +* Wed Jul 29 2020 Fedora Release Engineering - 1.4.6-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Sat May 16 2020 Kevin Fenzi - 1.4.6-8 - Add allow for podman's /dev/shm files (fixes bug #1828698 ) From 8e522edf6084c825af79102787520fec039462e5 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 16 Jan 2021 11:08:05 -0800 Subject: [PATCH 33/54] Drop check on libkeyutils, it's a legit library now. Fixes rhbz#1914662 Look for and use the ssh.d config snippet direction. Thanks John Dodson for patch. Fixes rhbz#1851620 --- rkhunter-1.4.6-drop-libkeyutils-check.patch | 43 +++++++++++++++++++++ rkhunter-1.4.6-ssh.d.patch | 25 ++++++++++++ rkhunter.spec | 13 ++++++- 3 files changed, 79 insertions(+), 2 deletions(-) create mode 100644 rkhunter-1.4.6-drop-libkeyutils-check.patch create mode 100644 rkhunter-1.4.6-ssh.d.patch diff --git a/rkhunter-1.4.6-drop-libkeyutils-check.patch b/rkhunter-1.4.6-drop-libkeyutils-check.patch new file mode 100644 index 0000000..b35ceaa --- /dev/null +++ b/rkhunter-1.4.6-drop-libkeyutils-check.patch @@ -0,0 +1,43 @@ +diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter +--- rkhunter-1.4.6.orig/files/rkhunter 2018-02-24 15:08:27.000000000 -0800 ++++ rkhunter-1.4.6/files/rkhunter 2021-01-15 12:47:54.399665856 -0800 +@@ -8370,9 +8370,7 @@ + /lib/libsbr.so + /lib64/libsbr.so + /lib/libslr.so +- /lib64/libslr.so +- /lib/tls/libkeyutils.so.1 +- /lib64/tls/libkeyutils.so.1" ++ /lib64/libslr.so" + EBURY_DIRS= + EBURY_KSYMS= + +@@ -9762,10 +9760,6 @@ + file:/usr/share/sshd.sync:Trojaned SSH daemon + file:/bin/zcut:Trojaned SSH daemon + file:/usr/bin/zmuie:Trojaned SSH daemon +- file:/lib/libkeyutils.so.1.9:Sniffer component +- file:/lib64/libkeyutils.so.1.9:Sniffer component +- file:/usr/lib/libkeyutils.so.1.9:Sniffer component +- file:/usr/lib64/libkeyutils.so.1.9:Sniffer component + file:/IptabLes:malware component + file:/.IptabLex:malware component + file:/boot/.IptabLex:malware component +@@ -9956,7 +9950,6 @@ + ssh-scan:Port scanner + atac:Port scanner component + \[pdflush\]:IRC bot +- libkeyutils.so.1.9:Spam tool component + .IptabLex:malware component + .IptabLes:malware component + .flush:malware component +diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb +--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb 2017-11-29 08:14:02.000000000 -0800 ++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb 1969-12-31 16:00:00.000000000 -0800 +@@ -1 +0,0 @@ +-RKH_libkeyutils.so.1.9-v1;Target:0;(((0&1&2)|(3&4&5))&((6&7&8)|(9&10)));58636174;58766572;58626e64;73686d6174;73686d6474;73686d676574;62696e64;636f6e6e656374;736f636b6574;737973636f6e66;746d7066696c65 +diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb +--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb 2017-11-29 08:14:02.000000000 -0800 ++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb 1969-12-31 16:00:00.000000000 -0800 +@@ -1 +0,0 @@ +-RKH_libkeyutils.1.9.so;Target:0;(0&1&2&3&4&5&6&7&8&9&10&11&12&13&14&15&16);737973636f6e66;746d7066696c65;77616974706964;736f636b6574;636f6e6e656374;73686d6174;73686d6474;73686d676574;73656d676574;73656d74696d65646f70;736c656570;737072696e7466;7372616e64;7374646f7574;737472636174;737472637079;5f5f737472647570 diff --git a/rkhunter-1.4.6-ssh.d.patch b/rkhunter-1.4.6-ssh.d.patch new file mode 100644 index 0000000..5c8997f --- /dev/null +++ b/rkhunter-1.4.6-ssh.d.patch @@ -0,0 +1,25 @@ +diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter +--- rkhunter-1.4.6.orig/files/rkhunter 2021-01-16 10:32:13.969438340 -0800 ++++ rkhunter-1.4.6/files/rkhunter 2021-01-16 10:35:59.737149750 -0800 +@@ -17379,6 +17379,12 @@ + fi + done + ++ if [ -d "${SSH_CONFIG_FILE}.d" ];then ++ SSH_CONFIG_FILE="${SSH_CONFIG_FILE} ${SSH_CONFIG_FILE}.d/*" ++ else ++ : ++ fi ++ + if [ -n "${SSH_CONFIG_FILE}" ]; then + display --to SCREEN+LOG --type PLAIN --result FOUND --color GREEN --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_FILE_SSH + +@@ -17396,7 +17402,7 @@ + # First we check for allowed root access. + # + +- RKHTMPVAR=`grep -i '^[ ]*PermitRootLogin[ =]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1` ++ RKHTMPVAR=`grep -ih '^[ ]*PermitRootLogin[ =]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1` + + if [ -n "${RKHTMPVAR}" ]; then + # diff --git a/rkhunter.spec b/rkhunter.spec index ded9ff1..f97897c 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 9%{?dist} +Release: 10%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -12,6 +12,10 @@ Source0: http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.ta Source2: 01-rkhunter Source3: rkhunter.sysconfig Patch0: rkhunter-1.4.6-fedoraconfig.patch +# libkeyutils is an actual legit library now, so this old check is a false positive. +Patch1: rkhunter-1.4.6-drop-libkeyutils-check.patch +# have ssh checks use the sshd.d directoy config files too. +Patch2: rkhunter-1.4.6-ssh.d.patch BuildArch: noarch BuildRequires: perl-generators @@ -82,9 +86,10 @@ EOF %{_sysconfdir}/cron.daily/%{name} %config(noreplace) %{_sysconfdir}/logrotate.d/%{name} %dir %{_var}/lib/%{name} -%{_var}/lib/%{name}/db +%dir %{_var}/lib/%{name}/db %ghost %{_var}/lib/%{name}/db/mirrors.dat %ghost %{_var}/lib/%{name}/db/programs_bad.dat +%ghost %{_var}/lib/%{name}/db/backdoorports.dat %{_var}/lib/%{name}/db/i18n %dir %{_var}/log/%{name} %config(noreplace) %{_sysconfdir}/%{name}.conf @@ -93,6 +98,10 @@ EOF %{_mandir}/man8/* %changelog +* Sat Jan 16 2021 Kevin Fenzi - 1.4.6-10 +- Drop check on libkeyutils, it's a legit library now. Fixes rhbz#1914662 +- Look for and use the ssh.d config snippet direction. Thanks John Dodson for patch. Fixes rhbz#1851620 + * Wed Jul 29 2020 Fedora Release Engineering - 1.4.6-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From a8f5de252c42bbca1eaa69042e435e37e56fa2bc Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 27 Jan 2021 15:20:53 +0000 Subject: [PATCH 34/54] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index f97897c..7154c04 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 10%{?dist} +Release: 11%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -98,6 +98,9 @@ EOF %{_mandir}/man8/* %changelog +* Wed Jan 27 2021 Fedora Release Engineering - 1.4.6-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Sat Jan 16 2021 Kevin Fenzi - 1.4.6-10 - Drop check on libkeyutils, it's a legit library now. Fixes rhbz#1914662 - Look for and use the ssh.d config snippet direction. Thanks John Dodson for patch. Fixes rhbz#1851620 From dde37ecefa85de9f1331d87aee25e4596a822b6c Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 7 Feb 2021 14:12:26 -0800 Subject: [PATCH 35/54] Fix bug around ssh protocol detection ( rhbz#1597635 ) --- rkhunter-1.4.6-ssh.d.patch | 22 ++++++++++++++++++++-- rkhunter.spec | 5 ++++- 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/rkhunter-1.4.6-ssh.d.patch b/rkhunter-1.4.6-ssh.d.patch index 5c8997f..244279c 100644 --- a/rkhunter-1.4.6-ssh.d.patch +++ b/rkhunter-1.4.6-ssh.d.patch @@ -1,6 +1,6 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter ---- rkhunter-1.4.6.orig/files/rkhunter 2021-01-16 10:32:13.969438340 -0800 -+++ rkhunter-1.4.6/files/rkhunter 2021-01-16 10:35:59.737149750 -0800 +--- rkhunter-1.4.6.orig/files/rkhunter 2021-02-07 13:58:43.355270731 -0800 ++++ rkhunter-1.4.6/files/rkhunter 2021-02-07 14:02:41.551554134 -0800 @@ -17379,6 +17379,12 @@ fi done @@ -23,3 +23,21 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunt if [ -n "${RKHTMPVAR}" ]; then # +@@ -17427,7 +17433,7 @@ + # Next we check to see if protocol version 1 is allowed. + # + +- RKHTMPVAR=`grep -i '^[ ]*Protocol[ =]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1` ++ RKHTMPVAR=`grep -i '^[ ]*Protocol[ =]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1` + + if [ -n "${RKHTMPVAR}" ]; then + # +@@ -17467,7 +17473,7 @@ + # First check for the Ebury backdoor. + # + +- RKHTMPVAR=`grep -i '^[ ]*AuthorizedKeysFile[ =]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1` ++ RKHTMPVAR=`grep -i '^[ ]*AuthorizedKeysFile[ =]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1` + + if [ -n "${RKHTMPVAR}" ]; then + RKHTMPVAR2=`echo ${RKHTMPVAR} | sed -e 's/^[^ =]*[ ]*=*[ ]*\([^ #]*\).*$/\1/'` diff --git a/rkhunter.spec b/rkhunter.spec index 7154c04..ecdb283 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 11%{?dist} +Release: 12%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -98,6 +98,9 @@ EOF %{_mandir}/man8/* %changelog +* Sun Feb 07 2021 Kevin Fenzi - 1.4.6-12 +- Fix bug around ssh protocol detection ( rhbz#1597635 ) + * Wed Jan 27 2021 Fedora Release Engineering - 1.4.6-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From 4845f0667d2ae546774584b47104bafb55c23838 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 23 Jul 2021 11:28:44 +0000 Subject: [PATCH 36/54] - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index ecdb283..838884a 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 12%{?dist} +Release: 13%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -98,6 +98,9 @@ EOF %{_mandir}/man8/* %changelog +* Fri Jul 23 2021 Fedora Release Engineering - 1.4.6-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + * Sun Feb 07 2021 Kevin Fenzi - 1.4.6-12 - Fix bug around ssh protocol detection ( rhbz#1597635 ) From 8723338aceba9f85c33af8c0434073f99edb1f35 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 6 Nov 2021 10:41:20 -0700 Subject: [PATCH 37/54] Add exclude for containers-common man page ( rhbz#2020015 ) --- rkhunter-1.4.6-fedoraconfig.patch | 14 ++++++++------ rkhunter.spec | 5 ++++- 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/rkhunter-1.4.6-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch index dcb6b07..66a6c40 100644 --- a/rkhunter-1.4.6-fedoraconfig.patch +++ b/rkhunter-1.4.6-fedoraconfig.patch @@ -1,6 +1,6 @@ -diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf +diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf --- rkhunter-1.4.6.orig/files/rkhunter.conf 2018-02-19 15:49:06.000000000 -0800 -+++ rkhunter-1.4.6/files/rkhunter.conf 2020-05-16 13:51:19.431725722 -0700 ++++ rkhunter-1.4.6/files/rkhunter.conf 2021-11-06 10:35:34.691842873 -0700 @@ -158,6 +158,7 @@ # default directory beneath the installation directory. # @@ -125,7 +125,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. # # Allow the specified hidden file to be whitelisted. -@@ -645,6 +681,32 @@ +@@ -645,6 +681,34 @@ #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac @@ -155,10 +155,12 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. +ALLOWHIDDENFILE=/etc/.bzrignore +# systemd +ALLOWHIDDENFILE=/etc/.updated ++# containers-common ++ALLOWHIDDENFILE=/usr/share/man/man5/.containerignore.5.gz # # Allow the specified process to use deleted files. The process name may be -@@ -714,6 +776,37 @@ +@@ -714,6 +778,37 @@ # #ALLOWDEVFILE=/dev/shm/pulse-shm-* #ALLOWDEVFILE=/dev/shm/sem.ADBE_* @@ -196,7 +198,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. # # Allow the specified process pathnames to use shared memory segments. -@@ -1090,6 +1183,11 @@ +@@ -1090,6 +1185,11 @@ # #RTKT_DIR_WHITELIST="" #RTKT_FILE_WHITELIST="" @@ -208,7 +210,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. # # The following option can be used to whitelist shared library files that would -@@ -1329,3 +1427,5 @@ +@@ -1329,3 +1429,5 @@ # The default value is '0'. # #GLOBSTAR=0 diff --git a/rkhunter.spec b/rkhunter.spec index 838884a..312efdc 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 13%{?dist} +Release: 14%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -98,6 +98,9 @@ EOF %{_mandir}/man8/* %changelog +* Sat Nov 06 2021 Kevin Fenzi - 1.4.6-14 +- Add exclude for containers-common man page ( rhbz#2020015 ) + * Fri Jul 23 2021 Fedora Release Engineering - 1.4.6-13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 56adbc656a5f3dbd4b00b4f5e4d36ca6c837efc5 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jan 2022 17:53:33 +0000 Subject: [PATCH 38/54] - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 312efdc..8c375e3 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 14%{?dist} +Release: 15%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -98,6 +98,9 @@ EOF %{_mandir}/man8/* %changelog +* Fri Jan 21 2022 Fedora Release Engineering - 1.4.6-15 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Sat Nov 06 2021 Kevin Fenzi - 1.4.6-14 - Add exclude for containers-common man page ( rhbz#2020015 ) From dacfb9e4cfe20d9d9b803b525cb81d1d0f7d34ac Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 11 Jun 2022 10:06:14 -0700 Subject: [PATCH 39/54] Whitelist .dockerignore man page ( rhbz#2050551 ) --- rkhunter-1.4.6-fedoraconfig.patch | 12 +++++++----- rkhunter.spec | 5 ++++- 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/rkhunter-1.4.6-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch index 66a6c40..143564d 100644 --- a/rkhunter-1.4.6-fedoraconfig.patch +++ b/rkhunter-1.4.6-fedoraconfig.patch @@ -1,6 +1,6 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf --- rkhunter-1.4.6.orig/files/rkhunter.conf 2018-02-19 15:49:06.000000000 -0800 -+++ rkhunter-1.4.6/files/rkhunter.conf 2021-11-06 10:35:34.691842873 -0700 ++++ rkhunter-1.4.6/files/rkhunter.conf 2022-06-11 09:58:09.740944517 -0700 @@ -158,6 +158,7 @@ # default directory beneath the installation directory. # @@ -125,7 +125,7 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/r # # Allow the specified hidden file to be whitelisted. -@@ -645,6 +681,34 @@ +@@ -645,6 +681,36 @@ #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac @@ -157,10 +157,12 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/r +ALLOWHIDDENFILE=/etc/.updated +# containers-common +ALLOWHIDDENFILE=/usr/share/man/man5/.containerignore.5.gz ++# containers-common (older versions) ++ALLOWHIDDENFILE=/usr/share/man/man5/.dockerignore.5.gz # # Allow the specified process to use deleted files. The process name may be -@@ -714,6 +778,37 @@ +@@ -714,6 +780,37 @@ # #ALLOWDEVFILE=/dev/shm/pulse-shm-* #ALLOWDEVFILE=/dev/shm/sem.ADBE_* @@ -198,7 +200,7 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/r # # Allow the specified process pathnames to use shared memory segments. -@@ -1090,6 +1185,11 @@ +@@ -1090,6 +1187,11 @@ # #RTKT_DIR_WHITELIST="" #RTKT_FILE_WHITELIST="" @@ -210,7 +212,7 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/r # # The following option can be used to whitelist shared library files that would -@@ -1329,3 +1429,5 @@ +@@ -1329,3 +1431,5 @@ # The default value is '0'. # #GLOBSTAR=0 diff --git a/rkhunter.spec b/rkhunter.spec index 8c375e3..b13fd39 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 15%{?dist} +Release: 16%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -98,6 +98,9 @@ EOF %{_mandir}/man8/* %changelog +* Sat Jun 11 2022 Kevin Fenzi - 1.4.6-16 +- Whitelist .dockerignore man page ( rhbz#2050551 ) + * Fri Jan 21 2022 Fedora Release Engineering - 1.4.6-15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 44210e0646c105a0f268dc3aa2edd595ddd75ecd Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 19 Jun 2022 15:06:25 -0700 Subject: [PATCH 40/54] Switch to using s-nail instead of mailx. --- rkhunter.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/rkhunter.spec b/rkhunter.spec index b13fd39..659e13d 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 16%{?dist} +Release: 17%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -21,7 +21,7 @@ BuildRequires: perl-generators Requires: coreutils, binutils, kmod, findutils, grep Requires: e2fsprogs, procps, lsof, iproute, wget -Requires: perl-interpreter, perl(strict), perl(IO::Socket), mailx, logrotate +Requires: perl-interpreter, perl(strict), perl(IO::Socket), s-nail, logrotate Requires: crontabs %description @@ -98,6 +98,9 @@ EOF %{_mandir}/man8/* %changelog +* Sun Jun 19 2022 Kevin Fenzi - 1.4.6-17 +- Switch to using s-nail instead of mailx. + * Sat Jun 11 2022 Kevin Fenzi - 1.4.6-16 - Whitelist .dockerignore man page ( rhbz#2050551 ) From 7793e743e6ff55c00592b51fbf62e4f2362a91c8 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 00:52:33 +0000 Subject: [PATCH 41/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 659e13d..c704bda 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 17%{?dist} +Release: 18%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -98,6 +98,9 @@ EOF %{_mandir}/man8/* %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 1.4.6-18 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Sun Jun 19 2022 Kevin Fenzi - 1.4.6-17 - Switch to using s-nail instead of mailx. From 7982b85a2a4af19c6d3f36bc9ae394ee4d13fe69 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 20 Jan 2023 19:48:37 +0000 Subject: [PATCH 42/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index c704bda..993a921 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 18%{?dist} +Release: 19%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -98,6 +98,9 @@ EOF %{_mandir}/man8/* %changelog +* Fri Jan 20 2023 Fedora Release Engineering - 1.4.6-19 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Sat Jul 23 2022 Fedora Release Engineering - 1.4.6-18 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 48e94c27b207df7e3115f1868f1c1018f788c82c Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Thu, 20 Apr 2023 18:02:26 -0700 Subject: [PATCH 43/54] Patch grep/egrep changes to avoid warnings in F38+ --- rkhunter-1.4.6-grep.patch | 712 ++++++++++++++++++++++++++++++++++++++ rkhunter.spec | 7 +- 2 files changed, 718 insertions(+), 1 deletion(-) create mode 100644 rkhunter-1.4.6-grep.patch diff --git a/rkhunter-1.4.6-grep.patch b/rkhunter-1.4.6-grep.patch new file mode 100644 index 0000000..8331ccf --- /dev/null +++ b/rkhunter-1.4.6-grep.patch @@ -0,0 +1,712 @@ +diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter +--- rkhunter-1.4.6.orig/files/rkhunter 2023-04-10 10:44:16.226859554 -0700 ++++ rkhunter-1.4.6/files/rkhunter 2023-04-20 17:57:11.365373544 -0700 +@@ -70,7 +70,7 @@ + # we exec to log everything to the debug file. + # + +-if [ -n "`echo \"$*\" | grep '\-\-debug'`" ]; then ++if [ -n "`echo \"$*\" | grep '\--debug'`" ]; then + RKHDEBUGFILE="" + RKHDEBUGBASE="/tmp/rkhunter-debug" + +@@ -181,9 +181,9 @@ + # used. If it is, then some typical grep tests will fail. + # + +-if [ "`echo \"rkh-grep-test\" | grep '^\+'`" = "rkh-grep-test" ]; then ++#if [ "`echo \"rkh-grep-test\" | grep '^\+'`" = "rkh-grep-test" ]; then + alias grep='grep -E' +-fi ++#fi + + + # +@@ -948,9 +948,9 @@ + # + + if [ "${OPT_NAME}" = "SHARED_LIB_WHITELIST" ]; then +- RKHTMPVAR=`echo "${OPT_VALUE}" | egrep '(^|[^\\])[][?*]'` ++ RKHTMPVAR=`echo "${OPT_VALUE}" | grep '(^|[^\\])[][?*]'` + else +- RKHTMPVAR=`echo "${OPT_VALUE}" | egrep '(^|[^\\])[][?*{}]'` ++ RKHTMPVAR=`echo "${OPT_VALUE}" | grep '(^|[^\\])[][?*{}]'` + fi + + if [ -n "${RKHTMPVAR}" ]; then +@@ -1000,7 +1000,7 @@ + # Also check that '/' has not been set. + # + +- if [ -n "`echo \"${FNAME}\" | egrep '(^[./]*$)|[;&]|/\.\./'`" ]; then ++ if [ -n "`echo \"${FNAME}\" | grep '(^[./]*$)|[;&]|/\.\./'`" ]; then + ERRCODE=1 + + echo "Invalid ${OPT_NAME} configuration option: Invalid pathname: ${FNAME}" +@@ -1134,7 +1134,7 @@ + # + + if [ "${OPT_NAME}" = "SHARED_LIB_WHITELIST" ]; then +- if [ -n "`echo \"${FNAME}\" | egrep '\\$\\{?(ORIGIN|LIB|PLATFORM)\\}?'`" ]; then ++ if [ -n "`echo \"${FNAME}\" | grep '\\$\\{?(ORIGIN|LIB|PLATFORM)\\}?'`" ]; then + continue + fi + fi +@@ -3848,7 +3848,7 @@ + # + + for RKHTMPVAR2 in ${RKHTMPVAR}; do +- if [ -n "`echo \"${RKHTMPVAR2}\" | egrep -i '^(TCP|UDP):[1-9][0-9]*$'`" ]; then ++ if [ -n "`echo \"${RKHTMPVAR2}\" | grep -i '^(TCP|UDP):[1-9][0-9]*$'`" ]; then + PROTO=`echo ${RKHTMPVAR2} | cut -d: -f1 | tr '[:lower:]' '[:upper:]'` + PORT=`echo ${RKHTMPVAR2} | cut -d: -f2` + +@@ -3899,7 +3899,7 @@ + PROTO="" + + # Dig out the protocol and port number, if present. +- if [ -n "`echo \"${RKHTMPVAR2}\" | egrep -i '.:(TCP|UDP):[1-9][0-9]*$'`" ]; then ++ if [ -n "`echo \"${RKHTMPVAR2}\" | grep -i '.:(TCP|UDP):[1-9][0-9]*$'`" ]; then + PROTO=`echo "${RKHTMPVAR2}" | sed -e 's/^.*:\([a-zA-Z]*\):[1-9][0-9]*$/\1/'` + PORT=`echo "${RKHTMPVAR2}" | sed -e 's/^.*:\([1-9][0-9]*\)$/\1/'` + +@@ -4839,7 +4839,7 @@ + fi + fi + +- if [ -n "`echo \"${HASH_FUNC}\" | egrep -i '^(MD5|SHA1|SHA224|SHA256|SHA384|SHA512|RIPEMD160|WHIRLPOOL|NONE)$'`" ]; then ++ if [ -n "`echo \"${HASH_FUNC}\" | grep -i '^(MD5|SHA1|SHA224|SHA256|SHA384|SHA512|RIPEMD160|WHIRLPOOL|NONE)$'`" ]; then + HASH_FUNC=`echo "${HASH_FUNC}" | tr '[:lower:]' '[:upper:]'` + fi + +@@ -6412,7 +6412,7 @@ + OSNAME="${OSNAME} `sw_vers 2>/dev/null | grep '^ProductVersion:' | sed -e 's/ProductVersion:[ ]*//'`" + # OSNAME="${OSNAME} `sysctl kern.version 2>/dev/null | sed -e 's/^kern.version = //' | cut -d: -f1`" + +- if [ -n "`sysctl -a 2>/dev/null | egrep '^(hw\.optional\.x86_64|hw\.optional\.64bitops|hw\.cpu64bit_capable).*1$'`" ]; then ++ if [ -n "`sysctl -a 2>/dev/null | grep '^(hw\.optional\.x86_64|hw\.optional\.64bitops|hw\.cpu64bit_capable).*1$'`" ]; then + OSNAME="${OSNAME} (64-bit capable)" + fi + ;; +@@ -6708,7 +6708,7 @@ + # this is what RPM does). + # + +- RPM_QUERY_RESULT=`echo "${RPM_QUERY_RESULT_ARCH}" | egrep ':(x86_64|ia64):' 2>/dev/null | tail ${TAIL_OPT}1` ++ RPM_QUERY_RESULT=`echo "${RPM_QUERY_RESULT_ARCH}" | grep ':(x86_64|ia64):' 2>/dev/null | tail ${TAIL_OPT}1` + + test -z "${RPM_QUERY_RESULT}" && RPM_QUERY_RESULT=`echo "${RPM_QUERY_RESULT_ARCH}" | tail ${TAIL_OPT}1` + +@@ -6883,7 +6883,7 @@ + if [ -n "${PKGNAME}" ]; then + if [ -f "/var/lib/dpkg/info/${PKGNAME}.md5sums" ]; then + FILNAM=`echo "${FNAME}" | sed -e 's:^/::; s:\.:\\\.:g'` +- SYSHASH=`egrep "( |\./)${FILNAM}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" 2>/dev/null | cut -d' ' -f1` ++ SYSHASH=`grep "( |\./)${FILNAM}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" 2>/dev/null | cut -d' ' -f1` + test -n "${SYSHASH}" && FILE_IS_PKGD=1 + fi + fi +@@ -6925,7 +6925,7 @@ + SYSHASH="" + RKHTMPVAR=`${HASH_CMD} "${FNAME}" 2>&1` + +- if [ -n "`echo \"${RKHTMPVAR}\" | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then ++ if [ -n "`echo \"${RKHTMPVAR}\" | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then + DEPENDENCY_ERR=1 + RKHTMPVAR=`echo "${RKHTMPVAR}" | tr '\n' ':' | sed -e 's/:$//'` + else +@@ -7311,13 +7311,13 @@ + + case $MIRRORS_MODE in + 0) +- MIRROR=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1` ++ MIRROR=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1` + ;; + 1) +- MIRROR=`egrep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1` ++ MIRROR=`grep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1` + ;; + 2) +- MIRROR=`egrep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1` ++ MIRROR=`grep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1` + ;; + esac + +@@ -7337,13 +7337,13 @@ + + case $MIRRORS_MODE in + 0) +- MIRROR=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-` ++ MIRROR=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-` + ;; + 1) +- MIRROR=`egrep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-` ++ MIRROR=`grep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-` + ;; + 2) +- MIRROR=`egrep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-` ++ MIRROR=`grep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-` + ;; + esac + +@@ -7370,7 +7370,7 @@ + # Next get the remaining mirrors. + # + +- OTHERMIRRORS=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | grep -v "^${MIRROR}\$"` ++ OTHERMIRRORS=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | grep -v "^${MIRROR}\$"` + + + # +@@ -7459,13 +7459,13 @@ + + case $MIRRORS_MODE in + 0) +- MIRROR_COUNT=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '` ++ MIRROR_COUNT=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '` + ;; + 1) +- MIRROR_COUNT=`egrep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '` ++ MIRROR_COUNT=`grep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '` + ;; + 2) +- MIRROR_COUNT=`egrep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '` ++ MIRROR_COUNT=`grep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '` + ;; + esac + +@@ -7991,7 +7991,7 @@ + # Now check to see if any unknown options have been configured. + # + +- RKHTMPVAR=`egrep -h -v '^[ ]*(#|$)' ${CONFIGFILE} ${LOCALCONFIGFILE} ${LOCALCONFDIRFILES}` ++ RKHTMPVAR=`grep -h -v '^[ ]*(#|$)' ${CONFIGFILE} ${LOCALCONFIGFILE} ${LOCALCONFDIRFILES}` + + IFS=$IFSNL + +@@ -10705,7 +10705,7 @@ + done + + +- if [ -n "`echo \"${RKHTMPVAR}\" | egrep 'libsafe|missing|empty'`" ]; then ++ if [ -n "`echo \"${RKHTMPVAR}\" | grep 'libsafe|missing|empty'`" ]; then + display --to LOG --type WARNING --nl PROPUPD_WARN + fi + +@@ -10957,7 +10957,7 @@ + + FILE_IS_PKGD=1 + +- PKGNAME=`echo "${PKGNAME_ARCH}" | egrep '\.(x86_64|ia64)$' 2>/dev/null | tail ${TAIL_OPT}1` ++ PKGNAME=`echo "${PKGNAME_ARCH}" | grep '\.(x86_64|ia64)$' 2>/dev/null | tail ${TAIL_OPT}1` + + test -z "${PKGNAME}" && PKGNAME=`echo "${PKGNAME_ARCH}" | tail ${TAIL_OPT}1` + +@@ -11156,7 +11156,7 @@ + if [ -n "${PKGNAME}" -a -f "/var/lib/dpkg/info/${PKGNAME}.md5sums" ]; then + FNGREP=`echo "${FNAMEGREP}" | sed -e 's:^/::'` + +- SYSHASH=`egrep "( |\./)${FNGREP}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" | cut -d' ' -f1` ++ SYSHASH=`grep "( |\./)${FNGREP}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" | cut -d' ' -f1` + + if [ -n "${SYSHASH}" ]; then + FILE_IS_PKGD=1 +@@ -11165,7 +11165,7 @@ + if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then + PKGMGR_VERIFY_RESULT="5" + +- if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then ++ if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then + DEPENDENCY_ERR=1 + fi + fi +@@ -11214,7 +11214,7 @@ + if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then + PKGMGR_VERIFY_RESULT="5" + +- if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then ++ if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then + DEPENDENCY_ERR=1 + fi + fi +@@ -11245,7 +11245,7 @@ + if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then + PKGMGR_VERIFY_RESULT="5" + +- if [ -n "`${PKGMGR_SHA_HASH} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then ++ if [ -n "`${PKGMGR_SHA_HASH} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then + DEPENDENCY_ERR=1 + fi + fi +@@ -11288,7 +11288,7 @@ + fi + fi + +- if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | egrep '5|(^..\?)'`" ]; then ++ if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep '5|(^..\?)'`" ]; then + HASH_TEST_PASSED=1 + else + TEST_RESULT="${TEST_RESULT} verify:hashchanged" +@@ -11342,7 +11342,7 @@ + SYSHASH=`${HASH_CMD} "${FNAME}" 2>/dev/null | cut -d' ' -f $HASH_FLD_IDX` + + if [ -z "${SYSHASH}" ]; then +- if [ -n "`${HASH_CMD} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then ++ if [ -n "`${HASH_CMD} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then + if [ "${RKHHASH}" = "ignore-prelink-dep-err" ]; then + SYSHASH="${RKHHASH}" + display --to LOG --type INFO FILE_PROP_IGNORE_PRELINK_DEP_ERR "`name2text \"${FNAME}\"`" +@@ -11438,7 +11438,7 @@ + # + + if [ $FILE_IS_PKGD -eq 1 ]; then +- echo "${PKGMGR_VERIFY_RESULT}" | egrep 'M|(^.\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:permchanged" ++ echo "${PKGMGR_VERIFY_RESULT}" | grep 'M|(^.\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:permchanged" + else + RKH_CC2=`expr $RKH_CC + 2` + +@@ -11458,7 +11458,7 @@ + # + + if [ $FILE_IS_PKGD -eq 1 ]; then +- echo "${PKGMGR_VERIFY_RESULT}" | egrep 'U|(^.....\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:uidchanged" ++ echo "${PKGMGR_VERIFY_RESULT}" | grep 'U|(^.....\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:uidchanged" + else + RKH_CC2=`expr $RKH_CC + 3` + +@@ -11478,7 +11478,7 @@ + # + + if [ $FILE_IS_PKGD -eq 1 ]; then +- echo "${PKGMGR_VERIFY_RESULT}" | egrep 'G|(^......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:gidchanged" ++ echo "${PKGMGR_VERIFY_RESULT}" | grep 'G|(^......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:gidchanged" + else + RKH_CC2=`expr $RKH_CC + 4` + +@@ -11518,7 +11518,7 @@ + # + + if [ $FILE_IS_PKGD -eq 1 ]; then +- if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | egrep 'S|(^\?)'`" ]; then ++ if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep 'S|(^\?)'`" ]; then + SIZE_TEST_PASSED=1 + else + TEST_RESULT="${TEST_RESULT} verify:sizechanged" +@@ -11546,7 +11546,7 @@ + # + + if [ $FILE_IS_PKGD -eq 1 ]; then +- echo "${PKGMGR_VERIFY_RESULT}" | egrep 'T|(^.......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:dtmchanged" ++ echo "${PKGMGR_VERIFY_RESULT}" | grep 'T|(^.......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:dtmchanged" + elif [ $PRELINKED -eq 0 -o $FILE_IS_PKGD -eq 0 ]; then + RKH_CC2=`expr $RKH_CC + 6` + +@@ -11567,7 +11567,7 @@ + + if [ -h "${FNAME}" ]; then + if [ $FILE_IS_PKGD -eq 1 ]; then +- if [ -n "`echo \"${PKGMGR_VERIFY_RESULT}\" | egrep 'L|(^....\?)'`" ]; then ++ if [ -n "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep 'L|(^....\?)'`" ]; then + if [ $HAVE_READLINK -eq 1 ]; then + # Check the link target to see if it is whitelisted. + +@@ -11713,7 +11713,7 @@ + RKHTMPVAR=`${LSATTR_CMD} "${FNAME}" 2>&1 | cut -d' ' -f1 | grep 'i'` + fi + else +- RKHTMPVAR=`ls -lno "${FNAME}" 2>&1 | ${AWK_CMD} '{ print $5 }' | egrep 'uchg|schg|sappnd|uappnd|sunlnk|sunlink|schange|simmutable|sappend|uappend|uchange|uimmutable'` ++ RKHTMPVAR=`ls -lno "${FNAME}" 2>&1 | ${AWK_CMD} '{ print $5 }' | grep 'uchg|schg|sappnd|uappnd|sunlnk|sunlink|schange|simmutable|sappend|uappend|uchange|uimmutable'` + fi + + # +@@ -11761,9 +11761,9 @@ + test -n "${BASENAME_CMD}" && RKHTMPVAR=`${BASENAME_CMD} "${FNAME}"` || RKHTMPVAR=`echo "${FNAME}" | sed -e 's:^.*/::'` + + if [ "${RKHTMPVAR}" = "rkhunter" ]; then +- SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | egrep -i -v '(shell|/bin/sh) script( |,|$)'` ++ SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | grep -i -v '(shell|/bin/sh) script( |,|$)'` + else +- SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | egrep -i ' script( |,|$)'` ++ SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | grep -i ' script( |,|$)'` + fi + + test -n "${SYSSCRIPT}" && TEST_RESULT="${TEST_RESULT} script" +@@ -12246,10 +12246,10 @@ + test ! -e "${SUSPSCAN_ITEM}" && continue + + # +- # Adding "text" to the egrep below widens scope at the expense of more false-positives and extending running time. ++ # Adding "text" to the grep below widens scope at the expense of more false-positives and extending running time. + # + +- if [ -n "`echo \"${FTYPE}\" | grep -v -i 'compres' | egrep -i 'execu|reloc|shell|libr|data|obj|text'`" ]; then ++ if [ -n "`echo \"${FTYPE}\" | grep -v -i 'compres' | grep -i 'execu|reloc|shell|libr|data|obj|text'`" ]; then + FOUND=1 + SUSPSCAN_NUM=1; SUSPSCAN_SCORE=0; SUSPSCAN_HITCOUNT=0 + SUSPSCAN_STRINGS="" +@@ -13144,7 +13144,7 @@ + FOUND=0 + + if [ -n "${KSYMS_FILE}" ]; then +- egrep -i 'adore|sebek' "${KSYMS_FILE}" >/dev/null 2>&1 && FOUND=1 ++ grep -i 'adore|sebek' "${KSYMS_FILE}" >/dev/null 2>&1 && FOUND=1 + fi + + if [ $FOUND -eq 0 ]; then +@@ -14054,7 +14054,7 @@ + + FNAMEGREP=`echo "${FNAMEGREP}" | sed -e 's/^|//;'` + +- if [ -n "`echo \"${FNAME}\" | egrep \"^(${FNAMEGREP})$\"`" ]; then ++ if [ -n "`echo \"${FNAME}\" | grep \"^(${FNAMEGREP})$\"`" ]; then + PROCWHITELISTED=1 + fi + else +@@ -14167,7 +14167,7 @@ + RKHLSOF_FILE="${TEMPFILE}" + touch "${RKHLSOF_FILE}" + +- ${LSOF_CMD} -wnlP +c 0 2>&1 | egrep -v ' (FIFO|V?DIR|IPv[46]) ' | sort | uniq >"${RKHLSOF_FILE}" ++ ${LSOF_CMD} -wnlP +c 0 2>&1 | grep -v ' (FIFO|V?DIR|IPv[46]) ' | sort | uniq >"${RKHLSOF_FILE}" + + # + # Now loop through the known suspicious filenames, +@@ -14369,7 +14369,7 @@ + ROOTKIT_COUNT=`expr $ROOTKIT_COUNT + 1` + + SEEN=1 +- FOUND_PROCS=`${UNHIDE_CMD} ${UNHIDE_OPTS} ${RKHTMPVAR} 2>&1 | egrep -v '^(Unhide |yjesus@|http:|Copyright |License |NOTE :|Used options:|\[\*\]|$)'` ++ FOUND_PROCS=`${UNHIDE_CMD} ${UNHIDE_OPTS} ${RKHTMPVAR} 2>&1 | grep -v '^(Unhide |yjesus@|http:|Copyright |License |NOTE :|Used options:|\[\*\]|$)'` + + if [ -z "${FOUND_PROCS}" ]; then + # Nothing found. +@@ -14950,7 +14950,7 @@ + IFS=$IFSNL + + # Get the default enabled services. +- for LINE in `egrep '^[ ]*enabled[ ]*\+?=' "${FILENAME}"`; do ++ for LINE in `grep '^[ ]*enabled[ ]*\+?=' "${FILENAME}"`; do + SEEN=1 + + RKHTMPVAR=`echo "${LINE}" | sed -e 's/^.*=//' | tr -s ' ' ' '` +@@ -14968,7 +14968,7 @@ + + + # Get the default disabled services. +- for LINE in `egrep '^[ ]*disabled[ ]*\+?=' "${FILENAME}"`; do ++ for LINE in `grep '^[ ]*disabled[ ]*\+?=' "${FILENAME}"`; do + RKHTMPVAR=`echo "${LINE}" | sed -e 's/^.*=//' | tr -s ' ' ' '` + + XINETD_DFLTS_DISABLED="${XINETD_DFLTS_DISABLED} ${RKHTMPVAR}" +@@ -15017,14 +15017,14 @@ + # + + if [ -n "${XINETD_DFLTS_ENABLED}" ]; then +- if [ -n "`echo \"${XINETD_DFLTS_ENABLED}\" | egrep \"${SVCID}\"`" ]; then +- if [ -z "`echo \"${XINETD_DFLTS_DISABLED}\" | egrep \"${SVCID}\"`" ]; then ++ if [ -n "`echo \"${XINETD_DFLTS_ENABLED}\" | grep \"${SVCID}\"`" ]; then ++ if [ -z "`echo \"${XINETD_DFLTS_DISABLED}\" | grep \"${SVCID}\"`" ]; then + SEEN=1 + IFS=$IFSNL + break + fi + fi +- elif [ -n "`echo \"${XINETD_DFLTS_DISABLED}\" | egrep \"${SVCID}\"`" ]; then ++ elif [ -n "`echo \"${XINETD_DFLTS_DISABLED}\" | grep \"${SVCID}\"`" ]; then + : + elif [ -z "`echo $DATA | grep 'disable = yes'`" ]; then + SEEN=1 +@@ -15361,7 +15361,7 @@ + test -f "${DIR}/mod_rootme2.so" && FOUNDFILES="${FOUNDFILES} ${DIR}/mod_rootme2.so" + + if [ -f "${DIR}/httpd.conf" ]; then +- if [ -n "`egrep 'mod_rootme2?\.so' \"${DIR}/httpd.conf\"`" ]; then ++ if [ -n "`grep 'mod_rootme2?\.so' \"${DIR}/httpd.conf\"`" ]; then + FOUNDFILES="${FOUNDFILES} ${DIR}/httpd.conf" + fi + fi +@@ -15664,7 +15664,7 @@ + ${FIND_CMD} "${LKM_PATH}" -type f -a \( -name "*.o" -o -name "*.ko" -o -name "*.ko.xz" \) >"${TEMPFILE}" 2>/dev/null + + for RKHTMPVAR in ${LKM_NAMES}; do +- if [ -n "`egrep \"/${RKHTMPVAR}(\.xz)?$\" "${TEMPFILE}"`" ]; then ++ if [ -n "`grep \"/${RKHTMPVAR}(\.xz)?$\" "${TEMPFILE}"`" ]; then + FOUND=1 + FOUNDFILES="${FOUNDFILES} ${RKHTMPVAR}" + fi +@@ -15814,10 +15814,10 @@ + if [ -n "`echo \"${LSOFLINE}\" | grep \" ${PROTO} \*:${PORT} \"`" ]; then + # Process listening for connections from anywhere. + PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'` +- elif [ -n "`echo \"${LSOFLINE}\" | egrep \" ${PROTO} [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:${PORT}[ -]\"`" ]; then ++ elif [ -n "`echo \"${LSOFLINE}\" | grep \" ${PROTO} [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:${PORT}[ -]\"`" ]; then + # Established or listening process using IPv4 address. + PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'` +- elif [ -n "`echo \"${LSOFLINE}\" | egrep \" ${PROTO} \[[:0-9a-fA-F]+\]:${PORT}[ -]\"`" ]; then ++ elif [ -n "`echo \"${LSOFLINE}\" | grep \" ${PROTO} \[[:0-9a-fA-F]+\]:${PORT}[ -]\"`" ]; then + # Established or listening process using IPv6 address. + PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'` + else +@@ -15879,7 +15879,7 @@ + if [ "${PROTO}" = "UDP" ]; then + FOUND=`${NETSTAT_CMD} -an | grep -i "^udp.*\.${PORT} " | ${AWK_CMD} '{ print $4 }' | grep "\.${PORT}$"` + elif [ "${PROTO}" = "TCP" ]; then +- FOUND=`${NETSTAT_CMD} -an | egrep -i "^tcp.*\.${PORT} .*(BOUND|ESTABLISH|LISTEN)" | ${AWK_CMD} '{ print $4 }' | grep "\.${PORT}$"` ++ FOUND=`${NETSTAT_CMD} -an | grep -i "^tcp.*\.${PORT} .*(BOUND|ESTABLISH|LISTEN)" | ${AWK_CMD} '{ print $4 }' | grep "\.${PORT}$"` + fi + ;; + SunOS) +@@ -15890,10 +15890,10 @@ + FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^UDP: IPv6/, /^$/ { print $1 }' | grep "\.${PORT}$"` + fi + elif [ "${PROTO}" = "TCP" ]; then +- FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv4/, /^$/ { print $0 }' | egrep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"` ++ FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv4/, /^$/ { print $0 }' | grep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"` + + if [ -z "${FOUND}" ]; then +- FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv6/, /^$/ { print $0 }' | egrep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"` ++ FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv6/, /^$/ { print $0 }' | grep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"` + fi + fi + ;; +@@ -16428,7 +16428,7 @@ + WHITEPROC="" + BLACKPROC="" + +- LIBPCAPRES=`egrep -v '(^sk | 888e )' /proc/net/packet 2>/dev/null | head ${HEAD_OPT}1` ++ LIBPCAPRES=`grep -v '(^sk | 888e )' /proc/net/packet 2>/dev/null | head ${HEAD_OPT}1` + + if [ -n "${LIBPCAPRES}" ]; then + ALLOWPROCLISTENERS="" +@@ -16444,7 +16444,7 @@ + + INODE_LIST="" + +- for INODE in `egrep -v '(^sk | 888e )' /proc/net/packet | ${AWK_CMD} '{ print $9 }'`; do ++ for INODE in `grep -v '(^sk | 888e )' /proc/net/packet | ${AWK_CMD} '{ print $9 }'`; do + INODE_LIST="${INODE_LIST}|$INODE" + done + +@@ -16452,7 +16452,7 @@ + test -z "${INODE_LIST}" && INODE_LIST="RKHunterPktCapture" + + +- for PID in `${LSOF_CMD} -lMnPw -d 1-20 2>/dev/null | egrep "[ ](pack[ ]+(${INODE_LIST})|sock[ ]+[^ ]+[ ]+[^ ]+[ ]+(${INODE_LIST}))[ ]" | ${AWK_CMD} '{ print $2 }'`; do ++ for PID in `${LSOF_CMD} -lMnPw -d 1-20 2>/dev/null | grep "[ ](pack[ ]+(${INODE_LIST})|sock[ ]+[^ ]+[ ]+[^ ]+[ ]+(${INODE_LIST}))[ ]" | ${AWK_CMD} '{ print $2 }'`; do + NAME="" + + if [ -h "/proc/$PID/exe" -a $HAVE_READLINK -eq 1 ]; then +@@ -16670,7 +16670,7 @@ + RKHTMPVAR=`grep "${STRING}" "${FNAME}"` + + if [ -n "${RKHTMPVAR}" ]; then +- test -z "`echo \"${RKHTMPVAR}\" | egrep -v '^[ ]*#'`" && continue ++ test -z "`echo \"${RKHTMPVAR}\" | grep -v '^[ ]*#'`" && continue + + if [ -n "`echo \"${RTKT_FILE_WHITELIST}\" | grep \"^${FNAMEGREP}:${STRING}$\"`" ]; then + if [ $VERBOSE_LOGGING -eq 1 ]; then +@@ -16944,7 +16944,7 @@ + if [ -n "${DSCL_CMD}" ]; then + display --to LOG --type INFO FOUND_CMD 'dscl' "${DSCL_CMD}" + +- RKHTMPVAR2=`${DSCL_CMD} . search /Users uid 0 | egrep '^[^ )]' | cut -d' ' -f1` ++ RKHTMPVAR2=`${DSCL_CMD} . search /Users uid 0 | grep '^[^ )]' | cut -d' ' -f1` + else + display --to LOG --type INFO NOT_FOUND_CMD 'dscl' + fi +@@ -17525,7 +17525,7 @@ + + test $SUNOS -eq 1 -o $IRIXOS -eq 1 && PS_ARGS="-ef" + +- RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep '(syslogd|syslog-ng)( |$)' | grep -v 'egrep'` ++ RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep '(syslogd|syslog-ng)( |$)' | grep -v 'grep'` + + if [ -n "${RKHTMPVAR}" ]; then + SYSLOG_SEEN=1 +@@ -17545,7 +17545,7 @@ + TITLE_SHOWN=1 + fi + +- RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep 'systemd-journald( |$)' | grep -v 'egrep'` ++ RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep 'systemd-journald( |$)' | grep -v 'grep'` + + if [ -n "${RKHTMPVAR}" ]; then + SYSTEMD_SEEN=1 +@@ -17561,7 +17561,7 @@ + TITLE_SHOWN=1 + fi + +- RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep 'metalog( |$)' | grep -v 'egrep'` ++ RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep 'metalog( |$)' | grep -v 'grep'` + + if [ -n "${RKHTMPVAR}" ]; then + METALOG_SEEN=1 +@@ -17577,7 +17577,7 @@ + TITLE_SHOWN=1 + fi + +- RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep 'socklog( |$)' | grep -v 'egrep'` ++ RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep 'socklog( |$)' | grep -v 'grep'` + + if [ -n "${RKHTMPVAR}" ]; then + SOCKLOG_SEEN=1 +@@ -17638,7 +17638,7 @@ + RKHTMPVAR="an" + elif [ -n "`echo \"${FNAME}\" | grep '/syslog-ng\.conf$'`" ]; then + FTYPE="syslog-ng" +- elif [ -n "`echo \"${FNAME}\" | egrep '/(systemd-)?journald\.conf$'`" ]; then ++ elif [ -n "`echo \"${FNAME}\" | grep '/(systemd-)?journald\.conf$'`" ]; then + FTYPE="systemd" + else + FTYPE="syslog" +@@ -17656,15 +17656,15 @@ + if [ "${FTYPE}" != "systemd" ]; then + RKHTMPVAR="" + +- if [ -n "`echo \"${FNAME}\" | egrep '/r?syslog\.conf$'`" ]; then +- RKHTMPVAR=`egrep -i '^[^#].*[ ](@|:omrelp:).' "${FNAME}" | egrep -i -v '(@|:omrelp:)127\.'` ++ if [ -n "`echo \"${FNAME}\" | grep '/r?syslog\.conf$'`" ]; then ++ RKHTMPVAR=`grep -i '^[^#].*[ ](@|:omrelp:).' "${FNAME}" | grep -i -v '(@|:omrelp:)127\.'` + else + # + # For syslog-ng we must look for a destination + # block which uses TCP or UDP. + # + +- RKHTMPVAR=`${AWK_CMD} '/^[ ]*destination( | |$)/, /}/ { print $0 }' "${FNAME}" | egrep -i '( | |\{|^)(tcp|udp)6?( | |\(|$)' | egrep -v -i '(tcp|udp)6?[ ]*\([ ]*("[ ]*)?127\.'` ++ RKHTMPVAR=`${AWK_CMD} '/^[ ]*destination( | |$)/, /}/ { print $0 }' "${FNAME}" | grep -i '( | |\{|^)(tcp|udp)6?( | |\(|$)' | grep -v -i '(tcp|udp)6?[ ]*\([ ]*("[ ]*)?127\.'` + fi + + if [ -n "${RKHTMPVAR}" ]; then +@@ -17680,7 +17680,7 @@ + # that the warnings are shown before anything else. + # + +- if [ $SYSLOG_SEEN -eq 1 -a -z "`echo \"${FILEFOUND}\" | egrep ' (syslog|rsyslog|syslog-ng) '`" ]; then ++ if [ $SYSLOG_SEEN -eq 1 -a -z "`echo \"${FILEFOUND}\" | grep ' (syslog|rsyslog|syslog-ng) '`" ]; then + display --to SCREEN+LOG --type PLAIN --result WARNING --color RED --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_FILE + display --to LOG --type WARNING SYSTEM_CONFIGS_SYSLOG_NO_FILE 'syslog' + elif [ $SYSTEMD_SEEN -eq 1 -a -z "`echo \"${FILEFOUND}\" | grep ' systemd '`" ]; then +@@ -17696,7 +17696,7 @@ + # We only display the remote logging result if a configuration file was found. + # + +- if [ -n "`echo \"${FILEFOUND}\" | egrep ' (syslog|rsyslog|syslog-ng) '`" ]; then ++ if [ -n "`echo \"${FILEFOUND}\" | grep ' (syslog|rsyslog|syslog-ng) '`" ]; then + if [ $ALLOW_SYSLOG_REMOTE_LOGGING -eq 1 ]; then + display --to SCREEN+LOG --type PLAIN --result ALLOWED --color GREEN --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_SYSLOG_REMOTE + elif [ $REM_LOGGING_FOUND -eq 0 ]; then +@@ -17733,7 +17733,7 @@ + FTYPE=`echo "${FTYPE}" | tail ${TAIL_OPT}1` + fi + +- if [ -z "`echo \"${FTYPE}\" | egrep -v '(character special|block special|socket|fifo \(named pipe\)|symbolic link to|empty|directory|/MAKEDEV:)'`" ]; then ++ if [ -z "`echo \"${FTYPE}\" | grep -v '(character special|block special|socket|fifo \(named pipe\)|symbolic link to|empty|directory|/MAKEDEV:)'`" ]; then + return + fi + +@@ -17831,7 +17831,7 @@ + RKHTMPVAR=`find_cmd mount` + + if [ -n "${RKHTMPVAR}" ]; then +- test -n "`${RKHTMPVAR} 2>/dev/null | egrep '^fdesc(fs)? .*(type fdesc|\(fdescfs\))'`" && FDESCFS=1 ++ test -n "`${RKHTMPVAR} 2>/dev/null | grep '^fdesc(fs)? .*(type fdesc|\(fdescfs\))'`" && FDESCFS=1 + else + display --to LOG --type INFO NOT_FOUND_CMD 'mount' + fi +@@ -17929,7 +17929,7 @@ + + for DIR in ${SHORTSEARCHDIRS}; do + if [ -d "${DIR}" ]; then +- RKHTMPVAR=`ls -1d ${DIR}/.* 2>/dev/null | egrep -v '/\.\.?$'` ++ RKHTMPVAR=`ls -1d ${DIR}/.* 2>/dev/null | grep -v '/\.\.?$'` + test -n "${RKHTMPVAR}" && LOOKINDIRS="${LOOKINDIRS} + ${RKHTMPVAR}" + fi +@@ -17971,7 +17971,7 @@ + + FTYPE=`${FILE_CMD} "${FNAME}" 2>&1 | ${AWK_CMD} -F':' '{ print $NF }' | cut -c2-` + +- test -n "`echo \"${FTYPE}\" | egrep 'character special|block special|empty'`" && continue ++ test -n "`echo \"${FTYPE}\" | grep 'character special|block special|empty'`" && continue + + FNAMEGREP=`echo "${FNAME}" | sed -e 's/\([.$*?\\]\)/\\\\\1/g; s/\[/\\\\[/g; s/\]/\\\\]/g'` + +@@ -18312,7 +18312,7 @@ + ;; + named) + WHOLE_VERSION=`${APP_CMD_FOUND} -v 2>/dev/null` +- VERSION=`echo "${WHOLE_VERSION}" | egrep '^(named|BIND)[ ][ ]*[0-9]' | grep -v '/' | ${AWK_CMD} '{ print $2 }'` ++ VERSION=`echo "${WHOLE_VERSION}" | grep '^(named|BIND)[ ][ ]*[0-9]' | grep -v '/' | ${AWK_CMD} '{ print $2 }'` + + if [ -n "`echo \"${VERSION}\" | grep '^[^-]*\.[0-9][0-9]*-P[^-]*-'`" ]; then + VERSION=`echo "${VERSION}" | cut -d'-' -f1-2` +@@ -18376,7 +18376,7 @@ + if [ -n "`echo \"${APP_WHITELIST}\" | grep -i \" ${APPLICATION}:${RKHTMPVAR} \"`" ]; then + APP_RESULTS="${APP_RESULTS} + ${APPLICATION}%${APPLICATION_DESC}%${VERSION}%-1" +- elif [ -n "`egrep -i \"^${APPLICATION}:.* ${RKHTMPVAR}( |$)\" \"${DB_PATH}/programs_bad.dat\" 2>&1`" ]; then ++ elif [ -n "`grep -i \"^${APPLICATION}:.* ${RKHTMPVAR}( |$)\" \"${DB_PATH}/programs_bad.dat\" 2>&1`" ]; then + APPS_FAILED_COUNT=`expr ${APPS_FAILED_COUNT} + 1` + + APP_RESULTS="${APP_RESULTS} +@@ -19009,7 +19009,7 @@ + + PROP_FILE_LIST="adduser amd awk basename bash bget cat chattr checkproc + chkconfig chmod chown chroot cp cron csh curl cut date depmod df +- diff dirname dmesg dpkg dpkg-query du echo ed egrep elinks env fgrep ++ diff dirname dmesg dpkg dpkg-query du echo ed grep elinks env fgrep + file find fsck fuser GET grep groupadd groupdel groupmod groups grpck head id + ifconfig ifdown ifstatus ifup inetd init insmod ip ipcs kallsyms kill + killall ksyms kudzu last lastlog ldd less links locate logger login +@@ -19031,7 +19031,7 @@ + SunOS) + PROP_FILE_LIST="${PROP_FILE_LIST} gawk gbasename gcat gchmod gchown + gcksum gcp gcut gdate gdiff gdiff3 gdirname gdu gecho +- gegrep genv gfile gfind ggrep ggroups ghead gid glocate ++ ggrep genv gfile gfind ggrep ggroups ghead gid glocate + gls gmd5sum gmv gpwd gsed gsize gsort gstrings gsum + gtail gtest gtouch guname guniq gusers gwc gwho gwhoami + inetadm nawk truss unhide unhide-posix unhide-tcp" +@@ -19792,8 +19792,8 @@ + # required commands are tested early on using just the root PATH. Then + # BINDIR is checked, and finally the rest of the commands are then + # checked using the new PATH from BINDIR. +-ABSOLUTELY_REQUIRED_CMDS="cut egrep grep sed tail tr" +-REQCMDS="awk cat chmod chown cp cut date egrep grep head ls mv sed sort tail touch tr uname uniq wc" ++ABSOLUTELY_REQUIRED_CMDS="cut grep grep sed tail tr" ++REQCMDS="awk cat chmod chown cp cut date grep grep head ls mv sed sort tail touch tr uname uniq wc" + + # This will be set to a list of commands that have been disabled. + DISABLED_CMDS="" +@@ -20903,10 +20903,10 @@ + # + + if [ -z "${PRELINK_HASH}" ]; then +- if [ -z "`echo \"${HASH_FUNC}\" | egrep '(/filehashsha\.pl Digest::MD5|/filehashsha\.pl .* 1$|shasum -a 1$)'`" ]; then ++ if [ -z "`echo \"${HASH_FUNC}\" | grep '(/filehashsha\.pl Digest::MD5|/filehashsha\.pl .* 1$|shasum -a 1$)'`" ]; then + RKHTMPVAR=`echo "${HASH_FUNC}" | cut -d' ' -f1` + +- if [ -z "`echo ${RKHTMPVAR} | egrep -i 'sha1|md5'`" ]; then ++ if [ -z "`echo ${RKHTMPVAR} | grep -i 'sha1|md5'`" ]; then + if [ $HASH_OPT -eq 1 ]; then + echo "This system uses prelinking, but the '--hash' option (${HASH_FUNC}) does not look like SHA1 or MD5." + else +@@ -21014,7 +21014,7 @@ + # + IFS=$IFSNL + +-for LINE in `egrep '^MSG_(TYPE|RESULT)_' "${DB_PATH}/i18n/en" 2>/dev/null`; do ++for LINE in `grep '^MSG_(TYPE|RESULT)_' "${DB_PATH}/i18n/en" 2>/dev/null`; do + TYPE=`echo "${LINE}" | cut -d: -f1` + + if [ "${LANGUAGE}" != "en" ]; then +@@ -21219,7 +21219,7 @@ + fi + elif [ -n "${PRELINK_HASH}" ]; then + display --to LOG --type INFO HASH_FUNC_PRELINK "${PRELINK_HASH}" +- elif [ -z "`echo \"${HASH_FUNC}\" | egrep -i 'sha1|md5'`" ]; then ++ elif [ -z "`echo \"${HASH_FUNC}\" | grep -i 'sha1|md5'`" ]; then + SKIP_HASH_MSG=1 + else + display --to LOG --type INFO HASH_FUNC "${HASH_FUNC}" diff --git a/rkhunter.spec b/rkhunter.spec index 993a921..be0b81e 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 19%{?dist} +Release: 20%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -16,6 +16,8 @@ Patch0: rkhunter-1.4.6-fedoraconfig.patch Patch1: rkhunter-1.4.6-drop-libkeyutils-check.patch # have ssh checks use the sshd.d directoy config files too. Patch2: rkhunter-1.4.6-ssh.d.patch +# Fix grep/egrep changes in f38+ +Patch3: rkhunter-1.4.6-grep.patch BuildArch: noarch BuildRequires: perl-generators @@ -98,6 +100,9 @@ EOF %{_mandir}/man8/* %changelog +* Mon Apr 10 2023 Kevin Fenzi - 1.4.6-20 +- Patch grep/egrep changes to avoid warnings in F38+ + * Fri Jan 20 2023 Fedora Release Engineering - 1.4.6-19 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 0054f1e6a10fb3896618254505c043f21bb93870 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 29 Apr 2023 10:26:27 -0700 Subject: [PATCH 44/54] More complete fix for egrep changes. --- rkhunter-1.4.6-grep.patch | 705 +------------------------------------- rkhunter.spec | 5 +- 2 files changed, 18 insertions(+), 692 deletions(-) diff --git a/rkhunter-1.4.6-grep.patch b/rkhunter-1.4.6-grep.patch index 8331ccf..fb249b5 100644 --- a/rkhunter-1.4.6-grep.patch +++ b/rkhunter-1.4.6-grep.patch @@ -1,6 +1,6 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter ---- rkhunter-1.4.6.orig/files/rkhunter 2023-04-10 10:44:16.226859554 -0700 -+++ rkhunter-1.4.6/files/rkhunter 2023-04-20 17:57:11.365373544 -0700 +--- rkhunter-1.4.6.orig/files/rkhunter 2023-04-29 09:32:39.288709203 -0700 ++++ rkhunter-1.4.6/files/rkhunter 2023-04-29 10:00:29.396271053 -0700 @@ -70,7 +70,7 @@ # we exec to log everything to the debug file. # @@ -10,703 +10,26 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunt RKHDEBUGFILE="" RKHDEBUGBASE="/tmp/rkhunter-debug" -@@ -181,9 +181,9 @@ +@@ -181,9 +181,11 @@ # used. If it is, then some typical grep tests will fail. # -if [ "`echo \"rkh-grep-test\" | grep '^\+'`" = "rkh-grep-test" ]; then ++# fedora always uses POSIX grep and set an alias here for depreciated egrep too +#if [ "`echo \"rkh-grep-test\" | grep '^\+'`" = "rkh-grep-test" ]; then alias grep='grep -E' -fi ++ alias egrep='grep -E' +#fi # -@@ -948,9 +948,9 @@ - # - - if [ "${OPT_NAME}" = "SHARED_LIB_WHITELIST" ]; then -- RKHTMPVAR=`echo "${OPT_VALUE}" | egrep '(^|[^\\])[][?*]'` -+ RKHTMPVAR=`echo "${OPT_VALUE}" | grep '(^|[^\\])[][?*]'` - else -- RKHTMPVAR=`echo "${OPT_VALUE}" | egrep '(^|[^\\])[][?*{}]'` -+ RKHTMPVAR=`echo "${OPT_VALUE}" | grep '(^|[^\\])[][?*{}]'` - fi - - if [ -n "${RKHTMPVAR}" ]; then -@@ -1000,7 +1000,7 @@ - # Also check that '/' has not been set. - # - -- if [ -n "`echo \"${FNAME}\" | egrep '(^[./]*$)|[;&]|/\.\./'`" ]; then -+ if [ -n "`echo \"${FNAME}\" | grep '(^[./]*$)|[;&]|/\.\./'`" ]; then - ERRCODE=1 - - echo "Invalid ${OPT_NAME} configuration option: Invalid pathname: ${FNAME}" -@@ -1134,7 +1134,7 @@ - # - - if [ "${OPT_NAME}" = "SHARED_LIB_WHITELIST" ]; then -- if [ -n "`echo \"${FNAME}\" | egrep '\\$\\{?(ORIGIN|LIB|PLATFORM)\\}?'`" ]; then -+ if [ -n "`echo \"${FNAME}\" | grep '\\$\\{?(ORIGIN|LIB|PLATFORM)\\}?'`" ]; then - continue - fi - fi -@@ -3848,7 +3848,7 @@ - # - - for RKHTMPVAR2 in ${RKHTMPVAR}; do -- if [ -n "`echo \"${RKHTMPVAR2}\" | egrep -i '^(TCP|UDP):[1-9][0-9]*$'`" ]; then -+ if [ -n "`echo \"${RKHTMPVAR2}\" | grep -i '^(TCP|UDP):[1-9][0-9]*$'`" ]; then - PROTO=`echo ${RKHTMPVAR2} | cut -d: -f1 | tr '[:lower:]' '[:upper:]'` - PORT=`echo ${RKHTMPVAR2} | cut -d: -f2` - -@@ -3899,7 +3899,7 @@ - PROTO="" - - # Dig out the protocol and port number, if present. -- if [ -n "`echo \"${RKHTMPVAR2}\" | egrep -i '.:(TCP|UDP):[1-9][0-9]*$'`" ]; then -+ if [ -n "`echo \"${RKHTMPVAR2}\" | grep -i '.:(TCP|UDP):[1-9][0-9]*$'`" ]; then - PROTO=`echo "${RKHTMPVAR2}" | sed -e 's/^.*:\([a-zA-Z]*\):[1-9][0-9]*$/\1/'` - PORT=`echo "${RKHTMPVAR2}" | sed -e 's/^.*:\([1-9][0-9]*\)$/\1/'` - -@@ -4839,7 +4839,7 @@ - fi - fi - -- if [ -n "`echo \"${HASH_FUNC}\" | egrep -i '^(MD5|SHA1|SHA224|SHA256|SHA384|SHA512|RIPEMD160|WHIRLPOOL|NONE)$'`" ]; then -+ if [ -n "`echo \"${HASH_FUNC}\" | grep -i '^(MD5|SHA1|SHA224|SHA256|SHA384|SHA512|RIPEMD160|WHIRLPOOL|NONE)$'`" ]; then - HASH_FUNC=`echo "${HASH_FUNC}" | tr '[:lower:]' '[:upper:]'` - fi - -@@ -6412,7 +6412,7 @@ - OSNAME="${OSNAME} `sw_vers 2>/dev/null | grep '^ProductVersion:' | sed -e 's/ProductVersion:[ ]*//'`" - # OSNAME="${OSNAME} `sysctl kern.version 2>/dev/null | sed -e 's/^kern.version = //' | cut -d: -f1`" - -- if [ -n "`sysctl -a 2>/dev/null | egrep '^(hw\.optional\.x86_64|hw\.optional\.64bitops|hw\.cpu64bit_capable).*1$'`" ]; then -+ if [ -n "`sysctl -a 2>/dev/null | grep '^(hw\.optional\.x86_64|hw\.optional\.64bitops|hw\.cpu64bit_capable).*1$'`" ]; then - OSNAME="${OSNAME} (64-bit capable)" - fi - ;; -@@ -6708,7 +6708,7 @@ - # this is what RPM does). - # - -- RPM_QUERY_RESULT=`echo "${RPM_QUERY_RESULT_ARCH}" | egrep ':(x86_64|ia64):' 2>/dev/null | tail ${TAIL_OPT}1` -+ RPM_QUERY_RESULT=`echo "${RPM_QUERY_RESULT_ARCH}" | grep ':(x86_64|ia64):' 2>/dev/null | tail ${TAIL_OPT}1` - - test -z "${RPM_QUERY_RESULT}" && RPM_QUERY_RESULT=`echo "${RPM_QUERY_RESULT_ARCH}" | tail ${TAIL_OPT}1` - -@@ -6883,7 +6883,7 @@ - if [ -n "${PKGNAME}" ]; then - if [ -f "/var/lib/dpkg/info/${PKGNAME}.md5sums" ]; then - FILNAM=`echo "${FNAME}" | sed -e 's:^/::; s:\.:\\\.:g'` -- SYSHASH=`egrep "( |\./)${FILNAM}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" 2>/dev/null | cut -d' ' -f1` -+ SYSHASH=`grep "( |\./)${FILNAM}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" 2>/dev/null | cut -d' ' -f1` - test -n "${SYSHASH}" && FILE_IS_PKGD=1 - fi - fi -@@ -6925,7 +6925,7 @@ - SYSHASH="" - RKHTMPVAR=`${HASH_CMD} "${FNAME}" 2>&1` - -- if [ -n "`echo \"${RKHTMPVAR}\" | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then -+ if [ -n "`echo \"${RKHTMPVAR}\" | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then - DEPENDENCY_ERR=1 - RKHTMPVAR=`echo "${RKHTMPVAR}" | tr '\n' ':' | sed -e 's/:$//'` - else -@@ -7311,13 +7311,13 @@ - - case $MIRRORS_MODE in - 0) -- MIRROR=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1` -+ MIRROR=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1` - ;; - 1) -- MIRROR=`egrep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1` -+ MIRROR=`grep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1` - ;; - 2) -- MIRROR=`egrep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1` -+ MIRROR=`grep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1` - ;; - esac - -@@ -7337,13 +7337,13 @@ - - case $MIRRORS_MODE in - 0) -- MIRROR=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-` -+ MIRROR=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-` - ;; - 1) -- MIRROR=`egrep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-` -+ MIRROR=`grep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-` - ;; - 2) -- MIRROR=`egrep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-` -+ MIRROR=`grep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-` - ;; - esac - -@@ -7370,7 +7370,7 @@ - # Next get the remaining mirrors. - # - -- OTHERMIRRORS=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | grep -v "^${MIRROR}\$"` -+ OTHERMIRRORS=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | grep -v "^${MIRROR}\$"` - - - # -@@ -7459,13 +7459,13 @@ - - case $MIRRORS_MODE in - 0) -- MIRROR_COUNT=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '` -+ MIRROR_COUNT=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '` - ;; - 1) -- MIRROR_COUNT=`egrep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '` -+ MIRROR_COUNT=`grep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '` - ;; - 2) -- MIRROR_COUNT=`egrep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '` -+ MIRROR_COUNT=`grep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '` - ;; - esac - -@@ -7991,7 +7991,7 @@ - # Now check to see if any unknown options have been configured. - # - -- RKHTMPVAR=`egrep -h -v '^[ ]*(#|$)' ${CONFIGFILE} ${LOCALCONFIGFILE} ${LOCALCONFDIRFILES}` -+ RKHTMPVAR=`grep -h -v '^[ ]*(#|$)' ${CONFIGFILE} ${LOCALCONFIGFILE} ${LOCALCONFDIRFILES}` - - IFS=$IFSNL - -@@ -10705,7 +10705,7 @@ - done - - -- if [ -n "`echo \"${RKHTMPVAR}\" | egrep 'libsafe|missing|empty'`" ]; then -+ if [ -n "`echo \"${RKHTMPVAR}\" | grep 'libsafe|missing|empty'`" ]; then - display --to LOG --type WARNING --nl PROPUPD_WARN - fi - -@@ -10957,7 +10957,7 @@ - - FILE_IS_PKGD=1 - -- PKGNAME=`echo "${PKGNAME_ARCH}" | egrep '\.(x86_64|ia64)$' 2>/dev/null | tail ${TAIL_OPT}1` -+ PKGNAME=`echo "${PKGNAME_ARCH}" | grep '\.(x86_64|ia64)$' 2>/dev/null | tail ${TAIL_OPT}1` - - test -z "${PKGNAME}" && PKGNAME=`echo "${PKGNAME_ARCH}" | tail ${TAIL_OPT}1` - -@@ -11156,7 +11156,7 @@ - if [ -n "${PKGNAME}" -a -f "/var/lib/dpkg/info/${PKGNAME}.md5sums" ]; then - FNGREP=`echo "${FNAMEGREP}" | sed -e 's:^/::'` - -- SYSHASH=`egrep "( |\./)${FNGREP}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" | cut -d' ' -f1` -+ SYSHASH=`grep "( |\./)${FNGREP}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" | cut -d' ' -f1` - - if [ -n "${SYSHASH}" ]; then - FILE_IS_PKGD=1 -@@ -11165,7 +11165,7 @@ - if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then - PKGMGR_VERIFY_RESULT="5" - -- if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then -+ if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then - DEPENDENCY_ERR=1 - fi - fi -@@ -11214,7 +11214,7 @@ - if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then - PKGMGR_VERIFY_RESULT="5" - -- if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then -+ if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then - DEPENDENCY_ERR=1 - fi - fi -@@ -11245,7 +11245,7 @@ - if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then - PKGMGR_VERIFY_RESULT="5" - -- if [ -n "`${PKGMGR_SHA_HASH} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then -+ if [ -n "`${PKGMGR_SHA_HASH} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then - DEPENDENCY_ERR=1 - fi - fi -@@ -11288,7 +11288,7 @@ - fi - fi - -- if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | egrep '5|(^..\?)'`" ]; then -+ if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep '5|(^..\?)'`" ]; then - HASH_TEST_PASSED=1 - else - TEST_RESULT="${TEST_RESULT} verify:hashchanged" -@@ -11342,7 +11342,7 @@ - SYSHASH=`${HASH_CMD} "${FNAME}" 2>/dev/null | cut -d' ' -f $HASH_FLD_IDX` - - if [ -z "${SYSHASH}" ]; then -- if [ -n "`${HASH_CMD} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then -+ if [ -n "`${HASH_CMD} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then - if [ "${RKHHASH}" = "ignore-prelink-dep-err" ]; then - SYSHASH="${RKHHASH}" - display --to LOG --type INFO FILE_PROP_IGNORE_PRELINK_DEP_ERR "`name2text \"${FNAME}\"`" -@@ -11438,7 +11438,7 @@ - # - - if [ $FILE_IS_PKGD -eq 1 ]; then -- echo "${PKGMGR_VERIFY_RESULT}" | egrep 'M|(^.\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:permchanged" -+ echo "${PKGMGR_VERIFY_RESULT}" | grep 'M|(^.\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:permchanged" - else - RKH_CC2=`expr $RKH_CC + 2` - -@@ -11458,7 +11458,7 @@ - # - - if [ $FILE_IS_PKGD -eq 1 ]; then -- echo "${PKGMGR_VERIFY_RESULT}" | egrep 'U|(^.....\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:uidchanged" -+ echo "${PKGMGR_VERIFY_RESULT}" | grep 'U|(^.....\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:uidchanged" - else - RKH_CC2=`expr $RKH_CC + 3` - -@@ -11478,7 +11478,7 @@ - # - - if [ $FILE_IS_PKGD -eq 1 ]; then -- echo "${PKGMGR_VERIFY_RESULT}" | egrep 'G|(^......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:gidchanged" -+ echo "${PKGMGR_VERIFY_RESULT}" | grep 'G|(^......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:gidchanged" - else - RKH_CC2=`expr $RKH_CC + 4` - -@@ -11518,7 +11518,7 @@ - # - - if [ $FILE_IS_PKGD -eq 1 ]; then -- if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | egrep 'S|(^\?)'`" ]; then -+ if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep 'S|(^\?)'`" ]; then - SIZE_TEST_PASSED=1 - else - TEST_RESULT="${TEST_RESULT} verify:sizechanged" -@@ -11546,7 +11546,7 @@ - # - - if [ $FILE_IS_PKGD -eq 1 ]; then -- echo "${PKGMGR_VERIFY_RESULT}" | egrep 'T|(^.......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:dtmchanged" -+ echo "${PKGMGR_VERIFY_RESULT}" | grep 'T|(^.......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:dtmchanged" - elif [ $PRELINKED -eq 0 -o $FILE_IS_PKGD -eq 0 ]; then - RKH_CC2=`expr $RKH_CC + 6` - -@@ -11567,7 +11567,7 @@ - - if [ -h "${FNAME}" ]; then - if [ $FILE_IS_PKGD -eq 1 ]; then -- if [ -n "`echo \"${PKGMGR_VERIFY_RESULT}\" | egrep 'L|(^....\?)'`" ]; then -+ if [ -n "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep 'L|(^....\?)'`" ]; then - if [ $HAVE_READLINK -eq 1 ]; then - # Check the link target to see if it is whitelisted. - -@@ -11713,7 +11713,7 @@ - RKHTMPVAR=`${LSATTR_CMD} "${FNAME}" 2>&1 | cut -d' ' -f1 | grep 'i'` - fi - else -- RKHTMPVAR=`ls -lno "${FNAME}" 2>&1 | ${AWK_CMD} '{ print $5 }' | egrep 'uchg|schg|sappnd|uappnd|sunlnk|sunlink|schange|simmutable|sappend|uappend|uchange|uimmutable'` -+ RKHTMPVAR=`ls -lno "${FNAME}" 2>&1 | ${AWK_CMD} '{ print $5 }' | grep 'uchg|schg|sappnd|uappnd|sunlnk|sunlink|schange|simmutable|sappend|uappend|uchange|uimmutable'` - fi - - # -@@ -11761,9 +11761,9 @@ - test -n "${BASENAME_CMD}" && RKHTMPVAR=`${BASENAME_CMD} "${FNAME}"` || RKHTMPVAR=`echo "${FNAME}" | sed -e 's:^.*/::'` - - if [ "${RKHTMPVAR}" = "rkhunter" ]; then -- SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | egrep -i -v '(shell|/bin/sh) script( |,|$)'` -+ SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | grep -i -v '(shell|/bin/sh) script( |,|$)'` - else -- SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | egrep -i ' script( |,|$)'` -+ SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | grep -i ' script( |,|$)'` - fi - - test -n "${SYSSCRIPT}" && TEST_RESULT="${TEST_RESULT} script" -@@ -12246,10 +12246,10 @@ - test ! -e "${SUSPSCAN_ITEM}" && continue - - # -- # Adding "text" to the egrep below widens scope at the expense of more false-positives and extending running time. -+ # Adding "text" to the grep below widens scope at the expense of more false-positives and extending running time. - # - -- if [ -n "`echo \"${FTYPE}\" | grep -v -i 'compres' | egrep -i 'execu|reloc|shell|libr|data|obj|text'`" ]; then -+ if [ -n "`echo \"${FTYPE}\" | grep -v -i 'compres' | grep -i 'execu|reloc|shell|libr|data|obj|text'`" ]; then - FOUND=1 - SUSPSCAN_NUM=1; SUSPSCAN_SCORE=0; SUSPSCAN_HITCOUNT=0 - SUSPSCAN_STRINGS="" -@@ -13144,7 +13144,7 @@ - FOUND=0 - - if [ -n "${KSYMS_FILE}" ]; then -- egrep -i 'adore|sebek' "${KSYMS_FILE}" >/dev/null 2>&1 && FOUND=1 -+ grep -i 'adore|sebek' "${KSYMS_FILE}" >/dev/null 2>&1 && FOUND=1 - fi - - if [ $FOUND -eq 0 ]; then -@@ -14054,7 +14054,7 @@ - - FNAMEGREP=`echo "${FNAMEGREP}" | sed -e 's/^|//;'` - -- if [ -n "`echo \"${FNAME}\" | egrep \"^(${FNAMEGREP})$\"`" ]; then -+ if [ -n "`echo \"${FNAME}\" | grep \"^(${FNAMEGREP})$\"`" ]; then - PROCWHITELISTED=1 - fi - else -@@ -14167,7 +14167,7 @@ - RKHLSOF_FILE="${TEMPFILE}" - touch "${RKHLSOF_FILE}" - -- ${LSOF_CMD} -wnlP +c 0 2>&1 | egrep -v ' (FIFO|V?DIR|IPv[46]) ' | sort | uniq >"${RKHLSOF_FILE}" -+ ${LSOF_CMD} -wnlP +c 0 2>&1 | grep -v ' (FIFO|V?DIR|IPv[46]) ' | sort | uniq >"${RKHLSOF_FILE}" - - # - # Now loop through the known suspicious filenames, -@@ -14369,7 +14369,7 @@ - ROOTKIT_COUNT=`expr $ROOTKIT_COUNT + 1` - - SEEN=1 -- FOUND_PROCS=`${UNHIDE_CMD} ${UNHIDE_OPTS} ${RKHTMPVAR} 2>&1 | egrep -v '^(Unhide |yjesus@|http:|Copyright |License |NOTE :|Used options:|\[\*\]|$)'` -+ FOUND_PROCS=`${UNHIDE_CMD} ${UNHIDE_OPTS} ${RKHTMPVAR} 2>&1 | grep -v '^(Unhide |yjesus@|http:|Copyright |License |NOTE :|Used options:|\[\*\]|$)'` - - if [ -z "${FOUND_PROCS}" ]; then - # Nothing found. -@@ -14950,7 +14950,7 @@ - IFS=$IFSNL - - # Get the default enabled services. -- for LINE in `egrep '^[ ]*enabled[ ]*\+?=' "${FILENAME}"`; do -+ for LINE in `grep '^[ ]*enabled[ ]*\+?=' "${FILENAME}"`; do - SEEN=1 - - RKHTMPVAR=`echo "${LINE}" | sed -e 's/^.*=//' | tr -s ' ' ' '` -@@ -14968,7 +14968,7 @@ - - - # Get the default disabled services. -- for LINE in `egrep '^[ ]*disabled[ ]*\+?=' "${FILENAME}"`; do -+ for LINE in `grep '^[ ]*disabled[ ]*\+?=' "${FILENAME}"`; do - RKHTMPVAR=`echo "${LINE}" | sed -e 's/^.*=//' | tr -s ' ' ' '` - - XINETD_DFLTS_DISABLED="${XINETD_DFLTS_DISABLED} ${RKHTMPVAR}" -@@ -15017,14 +15017,14 @@ - # - - if [ -n "${XINETD_DFLTS_ENABLED}" ]; then -- if [ -n "`echo \"${XINETD_DFLTS_ENABLED}\" | egrep \"${SVCID}\"`" ]; then -- if [ -z "`echo \"${XINETD_DFLTS_DISABLED}\" | egrep \"${SVCID}\"`" ]; then -+ if [ -n "`echo \"${XINETD_DFLTS_ENABLED}\" | grep \"${SVCID}\"`" ]; then -+ if [ -z "`echo \"${XINETD_DFLTS_DISABLED}\" | grep \"${SVCID}\"`" ]; then - SEEN=1 - IFS=$IFSNL - break - fi - fi -- elif [ -n "`echo \"${XINETD_DFLTS_DISABLED}\" | egrep \"${SVCID}\"`" ]; then -+ elif [ -n "`echo \"${XINETD_DFLTS_DISABLED}\" | grep \"${SVCID}\"`" ]; then - : - elif [ -z "`echo $DATA | grep 'disable = yes'`" ]; then - SEEN=1 -@@ -15361,7 +15361,7 @@ - test -f "${DIR}/mod_rootme2.so" && FOUNDFILES="${FOUNDFILES} ${DIR}/mod_rootme2.so" - - if [ -f "${DIR}/httpd.conf" ]; then -- if [ -n "`egrep 'mod_rootme2?\.so' \"${DIR}/httpd.conf\"`" ]; then -+ if [ -n "`grep 'mod_rootme2?\.so' \"${DIR}/httpd.conf\"`" ]; then - FOUNDFILES="${FOUNDFILES} ${DIR}/httpd.conf" - fi - fi -@@ -15664,7 +15664,7 @@ - ${FIND_CMD} "${LKM_PATH}" -type f -a \( -name "*.o" -o -name "*.ko" -o -name "*.ko.xz" \) >"${TEMPFILE}" 2>/dev/null - - for RKHTMPVAR in ${LKM_NAMES}; do -- if [ -n "`egrep \"/${RKHTMPVAR}(\.xz)?$\" "${TEMPFILE}"`" ]; then -+ if [ -n "`grep \"/${RKHTMPVAR}(\.xz)?$\" "${TEMPFILE}"`" ]; then - FOUND=1 - FOUNDFILES="${FOUNDFILES} ${RKHTMPVAR}" - fi -@@ -15814,10 +15814,10 @@ - if [ -n "`echo \"${LSOFLINE}\" | grep \" ${PROTO} \*:${PORT} \"`" ]; then - # Process listening for connections from anywhere. - PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'` -- elif [ -n "`echo \"${LSOFLINE}\" | egrep \" ${PROTO} [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:${PORT}[ -]\"`" ]; then -+ elif [ -n "`echo \"${LSOFLINE}\" | grep \" ${PROTO} [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:${PORT}[ -]\"`" ]; then - # Established or listening process using IPv4 address. - PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'` -- elif [ -n "`echo \"${LSOFLINE}\" | egrep \" ${PROTO} \[[:0-9a-fA-F]+\]:${PORT}[ -]\"`" ]; then -+ elif [ -n "`echo \"${LSOFLINE}\" | grep \" ${PROTO} \[[:0-9a-fA-F]+\]:${PORT}[ -]\"`" ]; then - # Established or listening process using IPv6 address. - PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'` - else -@@ -15879,7 +15879,7 @@ - if [ "${PROTO}" = "UDP" ]; then - FOUND=`${NETSTAT_CMD} -an | grep -i "^udp.*\.${PORT} " | ${AWK_CMD} '{ print $4 }' | grep "\.${PORT}$"` - elif [ "${PROTO}" = "TCP" ]; then -- FOUND=`${NETSTAT_CMD} -an | egrep -i "^tcp.*\.${PORT} .*(BOUND|ESTABLISH|LISTEN)" | ${AWK_CMD} '{ print $4 }' | grep "\.${PORT}$"` -+ FOUND=`${NETSTAT_CMD} -an | grep -i "^tcp.*\.${PORT} .*(BOUND|ESTABLISH|LISTEN)" | ${AWK_CMD} '{ print $4 }' | grep "\.${PORT}$"` - fi - ;; - SunOS) -@@ -15890,10 +15890,10 @@ - FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^UDP: IPv6/, /^$/ { print $1 }' | grep "\.${PORT}$"` - fi - elif [ "${PROTO}" = "TCP" ]; then -- FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv4/, /^$/ { print $0 }' | egrep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"` -+ FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv4/, /^$/ { print $0 }' | grep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"` - - if [ -z "${FOUND}" ]; then -- FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv6/, /^$/ { print $0 }' | egrep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"` -+ FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv6/, /^$/ { print $0 }' | grep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"` - fi - fi - ;; -@@ -16428,7 +16428,7 @@ - WHITEPROC="" - BLACKPROC="" - -- LIBPCAPRES=`egrep -v '(^sk | 888e )' /proc/net/packet 2>/dev/null | head ${HEAD_OPT}1` -+ LIBPCAPRES=`grep -v '(^sk | 888e )' /proc/net/packet 2>/dev/null | head ${HEAD_OPT}1` - - if [ -n "${LIBPCAPRES}" ]; then - ALLOWPROCLISTENERS="" -@@ -16444,7 +16444,7 @@ - - INODE_LIST="" - -- for INODE in `egrep -v '(^sk | 888e )' /proc/net/packet | ${AWK_CMD} '{ print $9 }'`; do -+ for INODE in `grep -v '(^sk | 888e )' /proc/net/packet | ${AWK_CMD} '{ print $9 }'`; do - INODE_LIST="${INODE_LIST}|$INODE" - done - -@@ -16452,7 +16452,7 @@ - test -z "${INODE_LIST}" && INODE_LIST="RKHunterPktCapture" - - -- for PID in `${LSOF_CMD} -lMnPw -d 1-20 2>/dev/null | egrep "[ ](pack[ ]+(${INODE_LIST})|sock[ ]+[^ ]+[ ]+[^ ]+[ ]+(${INODE_LIST}))[ ]" | ${AWK_CMD} '{ print $2 }'`; do -+ for PID in `${LSOF_CMD} -lMnPw -d 1-20 2>/dev/null | grep "[ ](pack[ ]+(${INODE_LIST})|sock[ ]+[^ ]+[ ]+[^ ]+[ ]+(${INODE_LIST}))[ ]" | ${AWK_CMD} '{ print $2 }'`; do - NAME="" - - if [ -h "/proc/$PID/exe" -a $HAVE_READLINK -eq 1 ]; then -@@ -16670,7 +16670,7 @@ - RKHTMPVAR=`grep "${STRING}" "${FNAME}"` - - if [ -n "${RKHTMPVAR}" ]; then -- test -z "`echo \"${RKHTMPVAR}\" | egrep -v '^[ ]*#'`" && continue -+ test -z "`echo \"${RKHTMPVAR}\" | grep -v '^[ ]*#'`" && continue - - if [ -n "`echo \"${RTKT_FILE_WHITELIST}\" | grep \"^${FNAMEGREP}:${STRING}$\"`" ]; then - if [ $VERBOSE_LOGGING -eq 1 ]; then -@@ -16944,7 +16944,7 @@ - if [ -n "${DSCL_CMD}" ]; then - display --to LOG --type INFO FOUND_CMD 'dscl' "${DSCL_CMD}" - -- RKHTMPVAR2=`${DSCL_CMD} . search /Users uid 0 | egrep '^[^ )]' | cut -d' ' -f1` -+ RKHTMPVAR2=`${DSCL_CMD} . search /Users uid 0 | grep '^[^ )]' | cut -d' ' -f1` - else - display --to LOG --type INFO NOT_FOUND_CMD 'dscl' - fi -@@ -17525,7 +17525,7 @@ - - test $SUNOS -eq 1 -o $IRIXOS -eq 1 && PS_ARGS="-ef" - -- RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep '(syslogd|syslog-ng)( |$)' | grep -v 'egrep'` -+ RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep '(syslogd|syslog-ng)( |$)' | grep -v 'grep'` - - if [ -n "${RKHTMPVAR}" ]; then - SYSLOG_SEEN=1 -@@ -17545,7 +17545,7 @@ - TITLE_SHOWN=1 - fi - -- RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep 'systemd-journald( |$)' | grep -v 'egrep'` -+ RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep 'systemd-journald( |$)' | grep -v 'grep'` - - if [ -n "${RKHTMPVAR}" ]; then - SYSTEMD_SEEN=1 -@@ -17561,7 +17561,7 @@ - TITLE_SHOWN=1 - fi - -- RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep 'metalog( |$)' | grep -v 'egrep'` -+ RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep 'metalog( |$)' | grep -v 'grep'` - - if [ -n "${RKHTMPVAR}" ]; then - METALOG_SEEN=1 -@@ -17577,7 +17577,7 @@ - TITLE_SHOWN=1 - fi - -- RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep 'socklog( |$)' | grep -v 'egrep'` -+ RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep 'socklog( |$)' | grep -v 'grep'` - - if [ -n "${RKHTMPVAR}" ]; then - SOCKLOG_SEEN=1 -@@ -17638,7 +17638,7 @@ - RKHTMPVAR="an" - elif [ -n "`echo \"${FNAME}\" | grep '/syslog-ng\.conf$'`" ]; then - FTYPE="syslog-ng" -- elif [ -n "`echo \"${FNAME}\" | egrep '/(systemd-)?journald\.conf$'`" ]; then -+ elif [ -n "`echo \"${FNAME}\" | grep '/(systemd-)?journald\.conf$'`" ]; then - FTYPE="systemd" - else - FTYPE="syslog" -@@ -17656,15 +17656,15 @@ - if [ "${FTYPE}" != "systemd" ]; then - RKHTMPVAR="" - -- if [ -n "`echo \"${FNAME}\" | egrep '/r?syslog\.conf$'`" ]; then -- RKHTMPVAR=`egrep -i '^[^#].*[ ](@|:omrelp:).' "${FNAME}" | egrep -i -v '(@|:omrelp:)127\.'` -+ if [ -n "`echo \"${FNAME}\" | grep '/r?syslog\.conf$'`" ]; then -+ RKHTMPVAR=`grep -i '^[^#].*[ ](@|:omrelp:).' "${FNAME}" | grep -i -v '(@|:omrelp:)127\.'` - else - # - # For syslog-ng we must look for a destination - # block which uses TCP or UDP. - # - -- RKHTMPVAR=`${AWK_CMD} '/^[ ]*destination( | |$)/, /}/ { print $0 }' "${FNAME}" | egrep -i '( | |\{|^)(tcp|udp)6?( | |\(|$)' | egrep -v -i '(tcp|udp)6?[ ]*\([ ]*("[ ]*)?127\.'` -+ RKHTMPVAR=`${AWK_CMD} '/^[ ]*destination( | |$)/, /}/ { print $0 }' "${FNAME}" | grep -i '( | |\{|^)(tcp|udp)6?( | |\(|$)' | grep -v -i '(tcp|udp)6?[ ]*\([ ]*("[ ]*)?127\.'` - fi - - if [ -n "${RKHTMPVAR}" ]; then -@@ -17680,7 +17680,7 @@ - # that the warnings are shown before anything else. - # - -- if [ $SYSLOG_SEEN -eq 1 -a -z "`echo \"${FILEFOUND}\" | egrep ' (syslog|rsyslog|syslog-ng) '`" ]; then -+ if [ $SYSLOG_SEEN -eq 1 -a -z "`echo \"${FILEFOUND}\" | grep ' (syslog|rsyslog|syslog-ng) '`" ]; then - display --to SCREEN+LOG --type PLAIN --result WARNING --color RED --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_FILE - display --to LOG --type WARNING SYSTEM_CONFIGS_SYSLOG_NO_FILE 'syslog' - elif [ $SYSTEMD_SEEN -eq 1 -a -z "`echo \"${FILEFOUND}\" | grep ' systemd '`" ]; then -@@ -17696,7 +17696,7 @@ - # We only display the remote logging result if a configuration file was found. - # - -- if [ -n "`echo \"${FILEFOUND}\" | egrep ' (syslog|rsyslog|syslog-ng) '`" ]; then -+ if [ -n "`echo \"${FILEFOUND}\" | grep ' (syslog|rsyslog|syslog-ng) '`" ]; then - if [ $ALLOW_SYSLOG_REMOTE_LOGGING -eq 1 ]; then - display --to SCREEN+LOG --type PLAIN --result ALLOWED --color GREEN --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_SYSLOG_REMOTE - elif [ $REM_LOGGING_FOUND -eq 0 ]; then -@@ -17733,7 +17733,7 @@ - FTYPE=`echo "${FTYPE}" | tail ${TAIL_OPT}1` - fi - -- if [ -z "`echo \"${FTYPE}\" | egrep -v '(character special|block special|socket|fifo \(named pipe\)|symbolic link to|empty|directory|/MAKEDEV:)'`" ]; then -+ if [ -z "`echo \"${FTYPE}\" | grep -v '(character special|block special|socket|fifo \(named pipe\)|symbolic link to|empty|directory|/MAKEDEV:)'`" ]; then - return - fi - -@@ -17831,7 +17831,7 @@ - RKHTMPVAR=`find_cmd mount` - - if [ -n "${RKHTMPVAR}" ]; then -- test -n "`${RKHTMPVAR} 2>/dev/null | egrep '^fdesc(fs)? .*(type fdesc|\(fdescfs\))'`" && FDESCFS=1 -+ test -n "`${RKHTMPVAR} 2>/dev/null | grep '^fdesc(fs)? .*(type fdesc|\(fdescfs\))'`" && FDESCFS=1 - else - display --to LOG --type INFO NOT_FOUND_CMD 'mount' - fi -@@ -17929,7 +17929,7 @@ - - for DIR in ${SHORTSEARCHDIRS}; do - if [ -d "${DIR}" ]; then -- RKHTMPVAR=`ls -1d ${DIR}/.* 2>/dev/null | egrep -v '/\.\.?$'` -+ RKHTMPVAR=`ls -1d ${DIR}/.* 2>/dev/null | grep -v '/\.\.?$'` - test -n "${RKHTMPVAR}" && LOOKINDIRS="${LOOKINDIRS} - ${RKHTMPVAR}" - fi -@@ -17971,7 +17971,7 @@ - - FTYPE=`${FILE_CMD} "${FNAME}" 2>&1 | ${AWK_CMD} -F':' '{ print $NF }' | cut -c2-` - -- test -n "`echo \"${FTYPE}\" | egrep 'character special|block special|empty'`" && continue -+ test -n "`echo \"${FTYPE}\" | grep 'character special|block special|empty'`" && continue - - FNAMEGREP=`echo "${FNAME}" | sed -e 's/\([.$*?\\]\)/\\\\\1/g; s/\[/\\\\[/g; s/\]/\\\\]/g'` - -@@ -18312,7 +18312,7 @@ - ;; - named) - WHOLE_VERSION=`${APP_CMD_FOUND} -v 2>/dev/null` -- VERSION=`echo "${WHOLE_VERSION}" | egrep '^(named|BIND)[ ][ ]*[0-9]' | grep -v '/' | ${AWK_CMD} '{ print $2 }'` -+ VERSION=`echo "${WHOLE_VERSION}" | grep '^(named|BIND)[ ][ ]*[0-9]' | grep -v '/' | ${AWK_CMD} '{ print $2 }'` - - if [ -n "`echo \"${VERSION}\" | grep '^[^-]*\.[0-9][0-9]*-P[^-]*-'`" ]; then - VERSION=`echo "${VERSION}" | cut -d'-' -f1-2` -@@ -18376,7 +18376,7 @@ - if [ -n "`echo \"${APP_WHITELIST}\" | grep -i \" ${APPLICATION}:${RKHTMPVAR} \"`" ]; then - APP_RESULTS="${APP_RESULTS} - ${APPLICATION}%${APPLICATION_DESC}%${VERSION}%-1" -- elif [ -n "`egrep -i \"^${APPLICATION}:.* ${RKHTMPVAR}( |$)\" \"${DB_PATH}/programs_bad.dat\" 2>&1`" ]; then -+ elif [ -n "`grep -i \"^${APPLICATION}:.* ${RKHTMPVAR}( |$)\" \"${DB_PATH}/programs_bad.dat\" 2>&1`" ]; then - APPS_FAILED_COUNT=`expr ${APPS_FAILED_COUNT} + 1` - - APP_RESULTS="${APP_RESULTS} -@@ -19009,7 +19009,7 @@ - - PROP_FILE_LIST="adduser amd awk basename bash bget cat chattr checkproc - chkconfig chmod chown chroot cp cron csh curl cut date depmod df -- diff dirname dmesg dpkg dpkg-query du echo ed egrep elinks env fgrep -+ diff dirname dmesg dpkg dpkg-query du echo ed grep elinks env fgrep - file find fsck fuser GET grep groupadd groupdel groupmod groups grpck head id - ifconfig ifdown ifstatus ifup inetd init insmod ip ipcs kallsyms kill - killall ksyms kudzu last lastlog ldd less links locate logger login -@@ -19031,7 +19031,7 @@ - SunOS) - PROP_FILE_LIST="${PROP_FILE_LIST} gawk gbasename gcat gchmod gchown - gcksum gcp gcut gdate gdiff gdiff3 gdirname gdu gecho -- gegrep genv gfile gfind ggrep ggroups ghead gid glocate -+ ggrep genv gfile gfind ggrep ggroups ghead gid glocate - gls gmd5sum gmv gpwd gsed gsize gsort gstrings gsum - gtail gtest gtouch guname guniq gusers gwc gwho gwhoami - inetadm nawk truss unhide unhide-posix unhide-tcp" -@@ -19792,8 +19792,8 @@ - # required commands are tested early on using just the root PATH. Then - # BINDIR is checked, and finally the rest of the commands are then - # checked using the new PATH from BINDIR. --ABSOLUTELY_REQUIRED_CMDS="cut egrep grep sed tail tr" --REQCMDS="awk cat chmod chown cp cut date egrep grep head ls mv sed sort tail touch tr uname uniq wc" -+ABSOLUTELY_REQUIRED_CMDS="cut grep grep sed tail tr" -+REQCMDS="awk cat chmod chown cp cut date grep grep head ls mv sed sort tail touch tr uname uniq wc" - - # This will be set to a list of commands that have been disabled. - DISABLED_CMDS="" -@@ -20903,10 +20903,10 @@ - # - - if [ -z "${PRELINK_HASH}" ]; then -- if [ -z "`echo \"${HASH_FUNC}\" | egrep '(/filehashsha\.pl Digest::MD5|/filehashsha\.pl .* 1$|shasum -a 1$)'`" ]; then -+ if [ -z "`echo \"${HASH_FUNC}\" | grep '(/filehashsha\.pl Digest::MD5|/filehashsha\.pl .* 1$|shasum -a 1$)'`" ]; then - RKHTMPVAR=`echo "${HASH_FUNC}" | cut -d' ' -f1` - -- if [ -z "`echo ${RKHTMPVAR} | egrep -i 'sha1|md5'`" ]; then -+ if [ -z "`echo ${RKHTMPVAR} | grep -i 'sha1|md5'`" ]; then - if [ $HASH_OPT -eq 1 ]; then - echo "This system uses prelinking, but the '--hash' option (${HASH_FUNC}) does not look like SHA1 or MD5." - else -@@ -21014,7 +21014,7 @@ - # - IFS=$IFSNL - --for LINE in `egrep '^MSG_(TYPE|RESULT)_' "${DB_PATH}/i18n/en" 2>/dev/null`; do -+for LINE in `grep '^MSG_(TYPE|RESULT)_' "${DB_PATH}/i18n/en" 2>/dev/null`; do - TYPE=`echo "${LINE}" | cut -d: -f1` - - if [ "${LANGUAGE}" != "en" ]; then -@@ -21219,7 +21219,7 @@ - fi - elif [ -n "${PRELINK_HASH}" ]; then - display --to LOG --type INFO HASH_FUNC_PRELINK "${PRELINK_HASH}" -- elif [ -z "`echo \"${HASH_FUNC}\" | egrep -i 'sha1|md5'`" ]; then -+ elif [ -z "`echo \"${HASH_FUNC}\" | grep -i 'sha1|md5'`" ]; then - SKIP_HASH_MSG=1 - else - display --to LOG --type INFO HASH_FUNC "${HASH_FUNC}" +@@ -9585,7 +9587,7 @@ + rpc.nfsd:tcp.log:Sniffer installed + sshd:/dev/ptyxx:OpenBSD Rootkit + sshd:/.config:SHV4 Rootkit +- sshd:+\\$.*\\$\!.*\!\!\\$:Backdoored SSH daemon installed ++ sshd:+\\$.*\\$!.*!!\\$:Backdoored SSH daemon installed + sshd:backdoor.h:Trojaned SSH daemon + sshd:backdoor_active:Trojaned SSH daemon + sshd:magic_pass_active:Trojaned SSH daemon diff --git a/rkhunter.spec b/rkhunter.spec index be0b81e..67513c5 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 20%{?dist} +Release: 21%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -100,6 +100,9 @@ EOF %{_mandir}/man8/* %changelog +* Sat Apr 29 2023 Kevin Fenzi - 1.4.6-21 +- More complete fix for egrep changes. + * Mon Apr 10 2023 Kevin Fenzi - 1.4.6-20 - Patch grep/egrep changes to avoid warnings in F38+ From b5d434e5901722242bde62d040bed50d6bea8fbc Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jul 2023 16:55:08 +0000 Subject: [PATCH 45/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 67513c5..100feaf 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 21%{?dist} +Release: 22%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -100,6 +100,9 @@ EOF %{_mandir}/man8/* %changelog +* Fri Jul 21 2023 Fedora Release Engineering - 1.4.6-22 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Sat Apr 29 2023 Kevin Fenzi - 1.4.6-21 - More complete fix for egrep changes. From 120f482d927547959528d9302c75b3065d7064c1 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Mon, 22 Jan 2024 11:39:32 +0000 Subject: [PATCH 46/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 100feaf..ecfc607 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 22%{?dist} +Release: 23%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -100,6 +100,9 @@ EOF %{_mandir}/man8/* %changelog +* Mon Jan 22 2024 Fedora Release Engineering - 1.4.6-23 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Fri Jul 21 2023 Fedora Release Engineering - 1.4.6-22 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 5cef75540d36e3ffbcee9d26b7f301a1ca6c3c5e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 26 Jan 2024 15:28:47 +0000 Subject: [PATCH 47/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index ecfc607..0537011 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 23%{?dist} +Release: 24%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -100,6 +100,9 @@ EOF %{_mandir}/man8/* %changelog +* Fri Jan 26 2024 Fedora Release Engineering - 1.4.6-24 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Mon Jan 22 2024 Fedora Release Engineering - 1.4.6-23 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From d622b8fee150b895bcdc7eafe613b31dfa85ce4e Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 19 Jul 2024 18:38:04 +0000 Subject: [PATCH 48/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 0537011..b5b4bfc 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 24%{?dist} +Release: 25%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -100,6 +100,9 @@ EOF %{_mandir}/man8/* %changelog +* Fri Jul 19 2024 Fedora Release Engineering - 1.4.6-25 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Fri Jan 26 2024 Fedora Release Engineering - 1.4.6-24 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From f8eba31470412dc25c9e482c665013be7e703e48 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Fri, 26 Jul 2024 02:39:10 +0200 Subject: [PATCH 49/54] convert GPLv2+ license to SPDX This is part of https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4 --- rkhunter.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/rkhunter.spec b/rkhunter.spec index b5b4bfc..df83c88 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,10 +3,11 @@ Name: rkhunter Version: 1.4.6 -Release: 25%{?dist} +Release: 26%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits -License: GPLv2+ +# Automatically converted from old format: GPLv2+ - review is highly recommended. +License: GPL-2.0-or-later URL: http://rkhunter.sourceforge.net/ Source0: http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz Source2: 01-rkhunter @@ -100,6 +101,9 @@ EOF %{_mandir}/man8/* %changelog +* Fri Jul 26 2024 Miroslav Suchý - 1.4.6-26 +- convert license to SPDX + * Fri Jul 19 2024 Fedora Release Engineering - 1.4.6-25 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From a8142de0d53e149172dd81df50ec81b5346fd528 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 18 Jan 2025 22:30:53 +0000 Subject: [PATCH 50/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index df83c88..9283a25 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 26%{?dist} +Release: 27%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits # Automatically converted from old format: GPLv2+ - review is highly recommended. @@ -101,6 +101,9 @@ EOF %{_mandir}/man8/* %changelog +* Sat Jan 18 2025 Fedora Release Engineering - 1.4.6-27 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Fri Jul 26 2024 Miroslav Suchý - 1.4.6-26 - convert license to SPDX From 5f79b238c239a8baac3fc696bf8ab341fd1001fd Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 19 Apr 2025 10:20:00 -0700 Subject: [PATCH 51/54] Add a fix to grep warning about escaping /s. Fixes rhbz#2360502 --- rkhunter-1.4.6-grep-fix.patch | 12 ++++++++++++ rkhunter.spec | 7 ++++++- 2 files changed, 18 insertions(+), 1 deletion(-) create mode 100644 rkhunter-1.4.6-grep-fix.patch diff --git a/rkhunter-1.4.6-grep-fix.patch b/rkhunter-1.4.6-grep-fix.patch new file mode 100644 index 0000000..7b265f8 --- /dev/null +++ b/rkhunter-1.4.6-grep-fix.patch @@ -0,0 +1,12 @@ +diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter +--- rkhunter-1.4.6.orig/files/rkhunter 2025-04-19 10:15:51.885823861 -0700 ++++ rkhunter-1.4.6/files/rkhunter 2025-04-19 10:11:38.420433420 -0700 +@@ -6691,7 +6691,7 @@ + # + + if [ $ERRCODE -eq 1 -a $BINISLINK -eq 1 ]; then +- if [ -n "`echo \"$FNAME\" | grep '^\/usr\/'`" ]; then ++ if [ -n "`echo \"$FNAME\" | grep '^/usr/'`" ]; then + RKHTMPVAR3=`echo "$FNAMEGREP" | sed -e 's:^/usr::'` + else + RKHTMPVAR3="/usr${FNAMEGREP}" diff --git a/rkhunter.spec b/rkhunter.spec index 9283a25..b59c71c 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 27%{?dist} +Release: 28%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits # Automatically converted from old format: GPLv2+ - review is highly recommended. @@ -19,6 +19,8 @@ Patch1: rkhunter-1.4.6-drop-libkeyutils-check.patch Patch2: rkhunter-1.4.6-ssh.d.patch # Fix grep/egrep changes in f38+ Patch3: rkhunter-1.4.6-grep.patch +# Fix grep warning about escaping / in f42+ +Patch4: rkhunter-1.4.6-grep-fix.patch BuildArch: noarch BuildRequires: perl-generators @@ -101,6 +103,9 @@ EOF %{_mandir}/man8/* %changelog +* Sat Apr 19 2025 Kevin Fenzi - 1.4.6-28 +- Add a fix to grep warning about escaping /s. Fixes rhbz#2360502 + * Sat Jan 18 2025 Fedora Release Engineering - 1.4.6-27 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 6292e46ab160d0b5733c7c5815b4a17fdc4f3e0f Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 4 May 2025 11:00:42 -0700 Subject: [PATCH 52/54] Add fix for additional case of grep warnings with cron. --- rkhunter-1.4.6-grep-fix.patch | 13 +++++++++++-- rkhunter.spec | 5 ++++- 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/rkhunter-1.4.6-grep-fix.patch b/rkhunter-1.4.6-grep-fix.patch index 7b265f8..d9c2f78 100644 --- a/rkhunter-1.4.6-grep-fix.patch +++ b/rkhunter-1.4.6-grep-fix.patch @@ -1,6 +1,6 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter ---- rkhunter-1.4.6.orig/files/rkhunter 2025-04-19 10:15:51.885823861 -0700 -+++ rkhunter-1.4.6/files/rkhunter 2025-04-19 10:11:38.420433420 -0700 +--- rkhunter-1.4.6.orig/files/rkhunter 2025-05-04 10:41:26.009520652 -0700 ++++ rkhunter-1.4.6/files/rkhunter 2025-05-04 10:37:49.439199695 -0700 @@ -6691,7 +6691,7 @@ # @@ -10,3 +10,12 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunt RKHTMPVAR3=`echo "$FNAMEGREP" | sed -e 's:^/usr::'` else RKHTMPVAR3="/usr${FNAMEGREP}" +@@ -11005,7 +11005,7 @@ + # + + if [ $ERRCODE -eq 1 -a $BINISLINK -eq 1 ]; then +- if [ -n "`echo \"${FNAME}\" | grep '^\/usr\/'`" ]; then ++ if [ -n "`echo \"${FNAME}\" | grep '^/usr/'`" ]; then + RKHTMPVAR3=`echo "${FNAMEGREP}" | sed -e 's:^/usr::'` + else + RKHTMPVAR3="/usr${FNAMEGREP}" diff --git a/rkhunter.spec b/rkhunter.spec index b59c71c..9f0310f 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 28%{?dist} +Release: 29%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits # Automatically converted from old format: GPLv2+ - review is highly recommended. @@ -103,6 +103,9 @@ EOF %{_mandir}/man8/* %changelog +* Sun May 04 2025 Kevin Fenzi - 1.4.6-29 +- Add fix for additional case of grep warnings with cron. + * Sat Apr 19 2025 Kevin Fenzi - 1.4.6-28 - Add a fix to grep warning about escaping /s. Fixes rhbz#2360502 From 31a16ee1fa7cf4dc690dacd9c0e84d2386b6609b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 11:59:42 +0000 Subject: [PATCH 53/54] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- rkhunter.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rkhunter.spec b/rkhunter.spec index 9f0310f..8ed252d 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 29%{?dist} +Release: 30%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits # Automatically converted from old format: GPLv2+ - review is highly recommended. @@ -103,6 +103,9 @@ EOF %{_mandir}/man8/* %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 1.4.6-30 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Sun May 04 2025 Kevin Fenzi - 1.4.6-29 - Add fix for additional case of grep warnings with cron. From 3474090453c9d4b6052b1df90d3a9c4bec3f4296 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 3 Jan 2026 10:43:13 -0800 Subject: [PATCH 54/54] Add patch to find systemd-journald config and avoid warning. Fixes rhbz#2361203 Add patch to fix false positive on Li0n from bin/sbin merge. Fixes rhbz#2382304 --- rkhunter-1.4.6-Li0n-fix.patch | 13 +++++++++++++ rkhunter-1.4.6-journald-config.patch | 12 ++++++++++++ rkhunter.spec | 10 +++++++++- 3 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 rkhunter-1.4.6-Li0n-fix.patch create mode 100644 rkhunter-1.4.6-journald-config.patch diff --git a/rkhunter-1.4.6-Li0n-fix.patch b/rkhunter-1.4.6-Li0n-fix.patch new file mode 100644 index 0000000..e484db2 --- /dev/null +++ b/rkhunter-1.4.6-Li0n-fix.patch @@ -0,0 +1,13 @@ +diff --color -Nur rkhunter-1.4.6/files/rkhunter rkhunter-1.4.6-build/rkhunter-1.4.6/files/rkhunter +--- rkhunter-1.4.6/files/rkhunter 2026-01-03 10:15:00.159046977 -0800 ++++ rkhunter-1.4.6/files/rkhunter 2026-01-03 10:22:54.440297219 -0800 +@@ -8680,8 +8680,7 @@ + + + # Lion Worm +- LION_FILES="/bin/in.telnetd +- /bin/mjy ++ LION_FILES="/bin/mjy + /usr/man/man1/man1/lib/.lib/mjy + /usr/man/man1/man1/lib/.lib/in.telnetd + /usr/man/man1/man1/lib/.lib/.x diff --git a/rkhunter-1.4.6-journald-config.patch b/rkhunter-1.4.6-journald-config.patch new file mode 100644 index 0000000..f214af7 --- /dev/null +++ b/rkhunter-1.4.6-journald-config.patch @@ -0,0 +1,12 @@ +diff --color -Nur rkhunter-1.4.6/files/rkhunter rkhunter-1.4.6-build/rkhunter-1.4.6/files/rkhunter +--- rkhunter-1.4.6/files/rkhunter 2026-01-03 10:15:00.159046977 -0800 ++++ rkhunter-1.4.6/files/rkhunter 2026-01-03 10:18:12.190029798 -0800 +@@ -17615,7 +17615,7 @@ + # + + if [ -z "${SYSLOG_CONFIG_FILE}" ]; then +- SYSLOG_CONFIG_FILE="/etc/syslog.conf /etc/rsyslog.conf /etc/syslog-ng/syslog-ng.conf /etc/systemd/journald.conf /etc/systemd/systemd-journald.conf" ++ SYSLOG_CONFIG_FILE="/etc/syslog.conf /etc/rsyslog.conf /etc/syslog-ng/syslog-ng.conf /etc/systemd/journald.conf /etc/systemd/systemd-journald.conf /usr/lib/systemd/journald.conf" + fi + + if [ "${SYSLOG_CONFIG_FILE}" = "NONE" ]; then diff --git a/rkhunter.spec b/rkhunter.spec index 8ed252d..aa2d9a2 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 30%{?dist} +Release: 31%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits # Automatically converted from old format: GPLv2+ - review is highly recommended. @@ -21,6 +21,10 @@ Patch2: rkhunter-1.4.6-ssh.d.patch Patch3: rkhunter-1.4.6-grep.patch # Fix grep warning about escaping / in f42+ Patch4: rkhunter-1.4.6-grep-fix.patch +# Fix systemd-journald config path +Patch5: rkhunter-1.4.6-journald-config.patch +# Fix false positive Li0n detection due to bin/sbin merge +Patch6: rkhunter-1.4.6-Li0n-fix.patch BuildArch: noarch BuildRequires: perl-generators @@ -103,6 +107,10 @@ EOF %{_mandir}/man8/* %changelog +* Sat Jan 03 2026 Kevin Fenzi - 1.4.6-31 +- Add patch to find systemd-journald config and avoid warning. Fixes rhbz#2361203 +- Add patch to fix false positive on Li0n from bin/sbin merge. Fixes rhbz#2382304 + * Fri Jul 25 2025 Fedora Release Engineering - 1.4.6-30 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild