From 4b9983734f889215d2e873d1ffeff0b4c46a95c1 Mon Sep 17 00:00:00 2001
From: cvsextras <cvsextras@fedoraproject.org>
Date: Mon, 8 Nov 2004 05:17:52 +0000
Subject: [PATCH 001/122] auto-import changelog data from
 rkhunter-1.1.8-0.fdr.1.src.rpm 1.1.8-0.fdr.1 (revisited) - Removed redundant
 buildrequires /bin/sh, coreutils and perl - Revise postun scriptlet - Added
 /usr/share/doc/rkhunter-1.1.8/ to files list 1.1.8-0.fdr.1 - Changed Release
 Tag to 0.fdr.1 (testing) for QA - Removed wget from dependencies - Hid
 (temporarily) the --skip-application-check command line option from     being
 listed in help - Fixed the spec files list, again! 1.1.8-0.fdr.0.2.beta2 -
 Unified and disabled the md5 canary check in prep (check is now optional)    
 removing the sha1 cross-check - Fixed the spec files list, adding the
 /var/rkhunter directory and the     /usr/bin/rkhunter executable - Fixed
 missing dependencies (rkh uses runtime checks) - Disabled "auto-clean" for
 rpmbuild -bb - Changed Application version scan default to disabled awaiting
 backport     fix in upstream sources - Fixed shared_man_search.patch,
 configuration files verify and added     postun(install) cleanup
 1.1.8-0.fdr.0.1.beta1 - More cosmetic patchwork - Changed Release Tag to
 beta1 (pre-release) for QA submit 1.1.8-0.fdr.1 - Removed hidden_search.patch
 (1.1.7) after it was merged into upstream     source by Michael Boelen -
 Removed .spec file from md5 and sha1 file checks (it must be modifiable    
 by Fedora QA release build) - Added BOOTSCAN description file to
 documentation - Restructured dynamic file creation ('Here' Docs) moving them
 to the     "prep" stage so that *_ALL_* files are available prior to the
 "build"     stage (for inspection purposes) - Added a /etc/sysconfig/rkhunter
 parameters file 1.1.7-0.fdr.1 - Cosmetic patchwork 1.1.6-0.fdr.1 - Moderate
 reworking of .spec file for packaging standards - Added md5 and sha1 file
 checks to prep procedure for source .rpm - Included an optional rc.local
 replacement for scan on boot (with full     logging) Tue Aug 10 2004 Michael
 Boelen - 1.1.5 - Added update script - Extended description Sun Aug 08 2004
 Greg Houlette - 1.1.5 - Changed the install procedure eliminating the
 specification of     destination filenames (only needed if you are renaming
 during install) - Changed the permissions for documentation files (root only
 overkill) - Added the installation of the rkhunter Man Page - Added the
 installation of the programs_{bad, good}.dat database files - Added the
 installation of the LICENSE documentation file - Added the chmod for root
 only to the /var/rkhunter/db directory Sun May 23 2004 Craig Orsinger (cjo)
 <cjorsinger@earthlink.net> - version 1.1.0-1.cjo - changed installation in
 accordance with new rootkit installation     procedure - changed installation
 root to conform to LSB. Use standard macros. - added recursive remove of old
 build root as prep for install phase Wed Apr 28 2004 Doncho N. Gunchev -
 1.0.9-0.mr700 - dropped Requires: perl - rkhunter works without it - dropped
 the bash alignpatch (check the source or contact me) - various file mode
 fixes (.../tmp/, *.db) - optimized the %files section - any new files in the
 current dirs will be     fine - just %{__install} them. Mon Apr 26 2004
 Michael Boelen - 1.0.8-0 - Fixed missing md5blacklist.dat Mon Apr 19 2004
 Doncho N. Gunchev - 1.0.6-1.mr700 - added missing
 /usr/local/rkhunter/db/md5blacklist.dat - patched to align results in
 --cronjob, I think rpm based distros have     symlink /bin/sh -> /bin/bash -
 added --with/--without alignpatch for conditional builds (in case    
 previous patch breaks something) Sat Apr 03 2004 Michael Boelen / Joe Klemmer
 - 1.0.6-0 - Update to 1.0.6 Mon Mar 29 2004 Doncho N. Gunchev - 1.0.0-0 -
 initial .spec file

---
 .cvsignore                              |   2 +
 rkhunter-1.1.8-0.fdr.1.src.md5          |   7 +
 rkhunter-1.1.8-app_check_default.patch  |  30 +++
 rkhunter-1.1.8-prelink_cleanup.patch    |  11 +
 rkhunter-1.1.8-shared_man_search.patch  |  11 +
 rkhunter-1.1.8-showfiles.patch          |  17 ++
 rkhunter-1.1.8-whitelist_dir-conf.patch |  12 ++
 rkhunter.spec                           | 271 ++++++++++++++++++++++++
 sources                                 |   2 +
 9 files changed, 363 insertions(+)
 create mode 100644 rkhunter-1.1.8-0.fdr.1.src.md5
 create mode 100644 rkhunter-1.1.8-app_check_default.patch
 create mode 100644 rkhunter-1.1.8-prelink_cleanup.patch
 create mode 100644 rkhunter-1.1.8-shared_man_search.patch
 create mode 100644 rkhunter-1.1.8-showfiles.patch
 create mode 100644 rkhunter-1.1.8-whitelist_dir-conf.patch
 create mode 100644 rkhunter.spec

diff --git a/.cvsignore b/.cvsignore
index e69de29..97678e9 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -0,0 +1,2 @@
+rkhunter-1.1.8.tar.gz
+rkhunter-scan_on_boot-rc.local.tar.gz
diff --git a/rkhunter-1.1.8-0.fdr.1.src.md5 b/rkhunter-1.1.8-0.fdr.1.src.md5
new file mode 100644
index 0000000..1c16a44
--- /dev/null
+++ b/rkhunter-1.1.8-0.fdr.1.src.md5
@@ -0,0 +1,7 @@
+91cae6f04582fb0b27c96784ffe5adae  ../SOURCES/rkhunter-1.1.8.tar.gz
+0728cef20dde6817c36ef5787286b6f6  ../SOURCES/rkhunter-scan_on_boot-rc.local.tar.gz
+4f749918a75c11e28efd235d363e9a6f  ../SOURCES/rkhunter-1.1.8-shared_man_search.patch
+b1525a7b472b96c669d6b7cd9048d6ed  ../SOURCES/rkhunter-1.1.8-showfiles.patch
+a76e5bcece252676355fd97b791f1000  ../SOURCES/rkhunter-1.1.8-whitelist_dir-conf.patch
+583368a65c82239fd1363f8cfa82a23a  ../SOURCES/rkhunter-1.1.8-app_check_default.patch
+a5cc9c9c8a7c91075dc2cfa9c370fc86  ../SOURCES/rkhunter-1.1.8-prelink_cleanup.patch
diff --git a/rkhunter-1.1.8-app_check_default.patch b/rkhunter-1.1.8-app_check_default.patch
new file mode 100644
index 0000000..9e9a311
--- /dev/null
+++ b/rkhunter-1.1.8-app_check_default.patch
@@ -0,0 +1,30 @@
+--- files/rkhunter.orig	2004-09-12 08:00:20.000000000 -0500
++++ files/rkhunter	2004-10-11 13:57:59.000000000 -0500
+@@ -49,7 +49,7 @@
+ # Skip passwd/group check
+ PASSWDCHECK_SKIP=0
+ # Application check
+-APPLICATION_CHECK=1
++APPLICATION_CHECK=0
+ 
+ 
+ if [ "`uname`" = "SunOS" ]; then
+@@ -186,6 +186,9 @@
+           shift
+ 	  ROOTDIR=$1
+           ;;
++      --run-application-check | --runapplicationcheck | --run-applicationcheck)
++          APPLICATION_CHECK=1
++          ;;
+       --scan-knownbad-files)
+           PERFORMKNOWNBAD=1
+           ;;
+@@ -4868,7 +4871,7 @@
+     echo $ECHOOPT "--report-mode*            : Don't show uninteresting information for reports"
+     echo $ECHOOPT "--report-warnings-only*   : Show only warnings (lesser output than --report-mode,"
+     echo $ECHOOPT "                            more than --quiet)"
+-    echo $ECHOOPT "--skip-application-check* : Don't run application version checks"
++#    echo $ECHOOPT "--skip-application-check* : Don't run application version checks"
+     echo $ECHOOPT "--skip-keypress*          : Don't wait after every test (non-interactive)"
+     echo $ECHOOPT "--quick*                  : Perform quick scan (instead of full scan)"
+     echo $ECHOOPT "--quiet*                  : Be quiet (only show warnings)"    
diff --git a/rkhunter-1.1.8-prelink_cleanup.patch b/rkhunter-1.1.8-prelink_cleanup.patch
new file mode 100644
index 0000000..e79c65b
--- /dev/null
+++ b/rkhunter-1.1.8-prelink_cleanup.patch
@@ -0,0 +1,11 @@
+--- files/rkhunter.orig	2004-09-12 08:00:20.000000000 -0500
++++ files/rkhunter	2004-10-07 00:21:30.000000000 -0500
+@@ -2276,6 +2276,8 @@
+ 	  lastfile="${file}"
+  
+ 	done
++	
++	[ -f ${TMPDIR}/prelink.tst ] && rm -f ${TMPDIR}/prelink.tst
+ 
+ 	if [ ${WARNING} -eq 1 ]; then
+ 	  displaytext "--------------------------------------------------------------------------------"
diff --git a/rkhunter-1.1.8-shared_man_search.patch b/rkhunter-1.1.8-shared_man_search.patch
new file mode 100644
index 0000000..8cd7ddc
--- /dev/null
+++ b/rkhunter-1.1.8-shared_man_search.patch
@@ -0,0 +1,11 @@
+--- files/rkhunter.orig	2004-09-12 08:00:20.000000000 -0500
++++ files/rkhunter	2004-09-27 23:47:08.000000000 -0500
+@@ -4045,7 +4045,7 @@
+ 	
+ 	displaytext -n "   Scanning for hidden files..."
+ 
+-	SEARCHINDIRS="/dev /bin /usr /usr/man /usr/man/man1 /usr/man/man8 /usr/bin /usr/sbin /sbin /etc"
++	SEARCHINDIRS="/dev /bin /usr /usr/share/man /usr/share/man/man1 /usr/share/man/man8 /usr/bin /usr/sbin /sbin /etc"
+ 	# Only reset status once
+ 	STATUS=0
+ 
diff --git a/rkhunter-1.1.8-showfiles.patch b/rkhunter-1.1.8-showfiles.patch
new file mode 100644
index 0000000..f32ebab
--- /dev/null
+++ b/rkhunter-1.1.8-showfiles.patch
@@ -0,0 +1,17 @@
+--- files/showfiles.pl.orig	2003-12-13 09:24:35.000000000 -0500
++++ files/showfiles.pl	2004-09-27 23:47:08.000000000 -0500
+@@ -12,11 +12,11 @@
+ 
+     foreach $file (@filenames)
+       {
+-	if ($file ne "." && $file ne "..")
++	if (substr($file,0,1) eq ".")
+ 	  {
+-	    if(substr($file,0,1) eq ".")
++	    if( ! ($file eq "." || $file eq ".."))
+ 	      {
+-	        print $viewdir,"/",$file,"\n";
++	        print $viewdir,"/",$file," ";
+ 	      }
+ 	  }
+       }
diff --git a/rkhunter-1.1.8-whitelist_dir-conf.patch b/rkhunter-1.1.8-whitelist_dir-conf.patch
new file mode 100644
index 0000000..58bb2a1
--- /dev/null
+++ b/rkhunter-1.1.8-whitelist_dir-conf.patch
@@ -0,0 +1,12 @@
+--- files/rkhunter.conf.orig	2004-08-20 10:02:59.000000000 -0500
++++ files/rkhunter.conf	2004-09-27 23:47:08.000000000 -0500
+@@ -25,4 +25,7 @@
+ #MD5WHITELIST=/bin/ps:9bd8bf260adc81d3a43a086fce6b430a
+ #MD5WHITELIST=/bin/ps:404583a6b166c2f7ac1287445a9de6b3
+ 
+-# The End
+\ No newline at end of file
++# Whitelist [hidden] directories
++#ALLOWHIDDENDIR=/etc/.java
++
++# The End
diff --git a/rkhunter.spec b/rkhunter.spec
new file mode 100644
index 0000000..762568c
--- /dev/null
+++ b/rkhunter.spec
@@ -0,0 +1,271 @@
+# We can't let RPM do the dependencies automatic because it'll then pick up
+# a correct but undesirable perl dependency, which rkhunter does not require
+# in order to function properly [perl(Digest::MD5) & perl(Digest::SHA1)].
+AutoReqProv:    no
+
+Name:           rkhunter
+Version:        1.1.8
+Release:        0.fdr.1
+Epoch:          0
+Summary:        Rootkit Hunter scans for rootkits, backdoors and local exploits.
+
+Group:          Applications/System
+License:        GPL
+URL:            http://www.rootkit.nl/
+Source0:        http://downloads.rootkit.nl/rkhunter-1.1.8.tar.gz
+Source1:        rkhunter-scan_on_boot-rc.local.tar.gz
+Source2:        rkhunter-1.1.8-0.fdr.1.src.md5
+Patch1:         rkhunter-1.1.8-whitelist_dir-conf.patch
+Patch2:         rkhunter-1.1.8-showfiles.patch
+Patch3:         rkhunter-1.1.8-shared_man_search.patch
+Patch4:         rkhunter-1.1.8-app_check_default.patch
+Patch5:         rkhunter-1.1.8-prelink_cleanup.patch
+BuildArch:      noarch
+BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+
+Requires:       /bin/sh, coreutils, binutils, modutils, findutils, grep
+Requires:       e2fsprogs, procps, lsof, prelink, iproute, net-tools
+Requires:       perl, perl(strict), perl(IO::Socket), nmap, mailx
+
+%description
+Rootkit Hunter is a scanning tool to ensure that you're about 99.9%%
+clean of nasty tools.  This tool scans for rootkits, backdoors and local
+exploits by running tests like:
+        - MD5 hash compare
+        - Look for default files used by rootkits
+        - Wrong file permissions for binaries
+        - Look for suspected strings in LKM and KLD modules
+        - Look for hidden files
+        - Optional scan within plaintext and binary files
+        - Software version checks
+        - Application tests
+
+Rootkit Hunter is released as a GPL licensed project and
+is free for everyone to use.
+
+
+%prep
+
+# This optional check is for verification of original sources
+# DURING the binary build process (md5 canary check)
+#[ ! -e %{_sourcedir}/%{name}-%{version}-0.fdr.1.src.md5.orig ] \
+#    && %{__perl} -pi.orig -e '
+#	s|../SOURCES|%{_sourcedir}|g;
+#     ' %{_sourcedir}/%{name}-%{version}-0.fdr.1.src.md5
+#md5sum --check %{_sourcedir}/%{name}-%{version}-0.fdr.1.src.md5 || exit $?
+
+%setup -q -n %{name}
+%setup -q -D -T -a 1 -n %{name}
+
+%{__perl} -pi.orig -e '
+	s|\@RKLIB\@|%{_libdir}/%{name}|g;
+	s|\@RCDIR\@|%{_sysconfdir}/rc.d|g;
+	s|\@LGDIR\@|%{_localstatedir}/log|g;
+    ' rkhunter-scan_on_boot
+
+%{__perl} -pi.orig -e '
+	s|\@RCDIR\@|%{_sysconfdir}/rc.d|g;
+	s|\@ITDIR\@|%{_initrddir}|g;
+	s|\@SCDIR\@|%{_sysconfdir}/sysconfig|g;
+	s|\@RKEXE\@|%{_bindir}/%{name}|g;
+    ' rkhunter-scan_on_boot-rc.local
+
+%patch1 -b .orig
+%patch2 -b .orig
+%patch3 -b .orig
+%patch4 -b .0001
+%patch5 -b .0002
+
+%{__cat} <<'EOF' >%{name}.sysconfig
+# System configuration file for Rootkit Hunter which
+# stores RPM system specifics for rc.local, etc.
+
+RKHUNTER_FLAGS="
+    --quiet
+    --create-logfile
+"
+EOF
+
+%{__cat} <<'EOF' >%{name}.conf
+## Next three lines installed automatically by RPM. Do not change
+## unless you know what you're doing...
+INSTALLDIR=%{_prefix}
+DBDIR=%{_var}/%{name}/db
+TMPDIR=%{_var}/%{name}/tmp
+
+EOF
+%{__cat} files/%{name}.conf >> %{name}.conf
+
+%{__cat} <<'EOF' >01-%{name}
+#!/bin/sh
+%{_bindir}/%{name} --cronjob | /bin/mail -s '%{name} Daily Run' root
+EOF
+
+
+%build
+#%%configure
+# We have nothing to configure... yet...
+
+
+%install
+%{__rm} -rf ${RPM_BUILD_ROOT}
+
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_bindir}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_sysconfdir}/{cron.daily,sysconfig}
+%{__mkdir} -m750 -p ${RPM_BUILD_ROOT}%{_libdir}/%{name}/{scripts,rc.d}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8
+%{__mkdir} -m750 -p ${RPM_BUILD_ROOT}%{_var}/%{name}/{db,tmp}
+
+%{__install} -m750 -p files/%{name}             ${RPM_BUILD_ROOT}%{_bindir}/
+
+%{__install} -m640 -p files/backdoorports.dat   ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
+%{__install} -m640 -p files/defaulthashes.dat   ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
+%{__install} -m640 -p files/md5blacklist.dat    ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
+%{__install} -m640 -p files/mirrors.dat         ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
+%{__install} -m640 -p files/os.dat              ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
+%{__install} -m640 -p files/programs_bad.dat    ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
+%{__install} -m640 -p files/programs_good.dat   ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
+
+%{__install} -m644 -p files/CHANGELOG           ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
+%{__install} -m644 -p files/LICENSE             ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
+%{__install} -m644 -p files/README              ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
+%{__install} -m644 -p files/WISHLIST            ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
+%{__install} -m644 -p rkhunter-scan_on_boot     ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/BOOTSCAN
+
+%{__install} -m644 -p files/development/*.8     ${RPM_BUILD_ROOT}%{_mandir}/man8/
+
+%{__install} -m750 -p files/check_modules.pl    ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
+%{__install} -m750 -p files/check_port.pl       ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
+%{__install} -m750 -p files/check_update.sh     ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
+%{__install} -m750 -p files/filehashmd5.pl      ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
+%{__install} -m750 -p files/filehashsha1.pl     ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
+%{__install} -m750 -p files/showfiles.pl        ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
+%{__install} -m750 -p 01-%{name}                ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/
+%{__install} -m750 -p rkhunter-scan_on_boot-rc.local ${RPM_BUILD_ROOT}%{_libdir}/%{name}/rc.d/rc.local
+%{__install} -m640 -p %{name}.conf              ${RPM_BUILD_ROOT}%{_sysconfdir}/
+%{__install} -m640 -p %{name}.sysconfig         ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name}
+
+
+%clean
+%{__rm} -rf $RPM_BUILD_ROOT
+# Autoclean for rpmbuild -bb
+#cd ..
+#%{__rm} -rf %{name}
+
+
+%postun
+if [ "$1" = 0 ]; then
+    [ ! -d %{_var}/%{name} ] || %{__rm} -rf %{_var}/%{name}
+    [ ! -d %{_libdir}/%{name} ] || %{__rm} -rf %{_libdir}/%{name}
+fi
+
+
+%files
+%defattr(-,root,root,-)
+%{_bindir}/%{name}
+%dir %{_libdir}/%{name}
+%{_libdir}/%{name}/scripts
+%{_libdir}/%{name}/rc.d
+%{_sysconfdir}/cron.daily/01-%{name}
+%dir %{_var}/%{name}
+%{_var}/%{name}/db
+%dir %{_var}/%{name}/tmp
+%config(noreplace) %{_sysconfdir}/%{name}.conf
+%config(noreplace) %{_sysconfdir}/sysconfig/%{name}
+%dir %{_docdir}/%{name}-%{version}
+%doc %{_docdir}/%{name}-%{version}/*
+%{_mandir}/man8/*
+
+
+%changelog
+* Fri Oct 15 2004 Greg Houlette - 0:1.1.8-0.fdr.1 (revisited)
+- Removed redundant buildrequires /bin/sh, coreutils and perl
+- Revise postun scriptlet
+- Added /usr/share/doc/rkhunter-1.1.8/ to files list
+
+* Mon Oct 11 2004 Greg Houlette - 0:1.1.8-0.fdr.1
+- Changed Release Tag to 0.fdr.1 (testing) for QA
+- Removed wget from dependencies
+- Hid (temporarily) the --skip-application-check command
+  line option from being listed in help
+- Fixed the spec files list, again!
+
+* Fri Oct 8 2004 Greg Houlette - 0:1.1.8-0.fdr.0.2.beta2
+- Unified and disabled the md5 canary check in prep
+  (check is now optional) removing the sha1 cross-check
+- Fixed the spec files list, adding the /var/rkhunter
+  directory and the /usr/bin/rkhunter executable
+- Fixed missing dependencies (rkh uses runtime checks)
+- Disabled "auto-clean" for rpmbuild -bb
+- Changed Application version scan default to
+  disabled awaiting backport fix in upstream sources
+- Fixed shared_man_search.patch, configuration files
+  verify and added postun(install) cleanup
+
+* Fri Oct 1 2004 Greg Houlette - 0:1.1.8-0.fdr.0.1.beta1
+- More cosmetic patchwork
+- Changed Release Tag to beta1 (pre-release) for QA submit
+
+* Tue Sep 28 2004 Greg Houlette - 0:1.1.8-0.fdr.1
+- Removed hidden_search.patch (1.1.7) after it was
+  merged into upstream source by Michael Boelen
+- Removed .spec file from md5 and sha1 file checks
+  (it must be modifiable by Fedora QA release build)
+- Added BOOTSCAN description file to documentation
+- Restructured dynamic file creation ('Here' Docs)
+  moving them to the "prep" stage so that *_ALL_*
+  files are available prior to the "build" stage
+  (for inspection purposes)
+- Added a /etc/sysconfig/rkhunter parameters file
+
+* Sun Aug 29 2004 Greg Houlette - 0:1.1.7-0.fdr.1
+- Cosmetic patchwork
+
+* Sat Aug 21 2004 Greg Houlette - 0:1.1.6-0.fdr.1
+- Moderate reworking of .spec file for packaging standards
+- Added md5 and sha1 file checks to prep procedure for source .rpm
+- Included an optional rc.local replacement for scan on boot (with full logging)
+
+* Tue Aug 10 2004 Michael Boelen - 1.1.5
+- Added update script
+- Extended description
+
+* Sun Aug 08 2004 Greg Houlette - 1.1.5
+- Changed the install procedure eliminating the specification of
+  destination filenames (only needed if you are renaming during install)
+- Changed the permissions for documentation files (root only overkill)
+- Added the installation of the rkhunter Man Page
+- Added the installation of the programs_{bad, good}.dat database files
+- Added the installation of the LICENSE documentation file
+- Added the chmod for root only to the /var/rkhunter/db directory
+
+* Sun May 23 2004 Craig Orsinger (cjo) <cjorsinger@earthlink.net>
+- version 1.1.0-1.cjo
+- changed installation in accordance with new rootkit installation
+  procedure
+- changed installation root to conform to LSB. Use standard macros.
+- added recursive remove of old build root as prep for install phase
+
+* Wed Apr 28 2004 Doncho N. Gunchev - 1.0.9-0.mr700
+- dropped Requires: perl - rkhunter works without it 
+- dropped the bash alignpatch (check the source or contact me)
+- various file mode fixes (.../tmp/, *.db)
+- optimized the %%files section - any new files in the
+  current dirs will be fine - just %%{__install} them.
+
+* Mon Apr 26 2004 Michael Boelen - 1.0.8-0
+- Fixed missing md5blacklist.dat
+
+* Mon Apr 19 2004 Doncho N. Gunchev - 1.0.6-1.mr700
+- added missing /usr/local/rkhunter/db/md5blacklist.dat
+- patched to align results in --cronjob, I think rpm based
+  distros have symlink /bin/sh -> /bin/bash
+- added --with/--without alignpatch for conditional builds
+  (in case previous patch breaks something)
+
+* Sat Apr 03 2004 Michael Boelen / Joe Klemmer - 1.0.6-0
+- Update to 1.0.6
+
+* Mon Mar 29 2004 Doncho N. Gunchev - 1.0.0-0
+- initial .spec file
diff --git a/sources b/sources
index e69de29..623f3a5 100644
--- a/sources
+++ b/sources
@@ -0,0 +1,2 @@
+91cae6f04582fb0b27c96784ffe5adae  rkhunter-1.1.8.tar.gz
+0728cef20dde6817c36ef5787286b6f6  rkhunter-scan_on_boot-rc.local.tar.gz

From c0c8bdf520ea24f462142d660eec32fb32d41647 Mon Sep 17 00:00:00 2001
From: gafton <gafton@fedoraproject.org>
Date: Wed, 24 Nov 2004 04:54:28 +0000
Subject: [PATCH 002/122] Fix braindead typo from the original import

---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 0639c2d..633afa8 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,5 @@
 # Makefile for source rpm: rkhunter
-# $Id$
+# $Id: Makefile,v 1.1 2004/11/08 05:17:50 cvsextras Exp $
 NAME := rkhunter
 SPECFILE = $(firstword $(wildcard *.spec))
 
@@ -12,7 +12,7 @@ MAKEFILE_COMMON	:= $(shell $(find-makefile-common))
 ifeq ($(MAKEFILE_COMMON),)
 # attept a checkout
 define checkout-makefile-common
-test -f CVS/Rootx && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
+test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
 endef
 
 MAKEFILE_COMMON := $(shell $(checkout-makefile-common))

From f933577007391db48390084744185e6ddffdc97f Mon Sep 17 00:00:00 2001
From: Michael Schwendt <mschwendt@fedoraproject.org>
Date: Fri, 10 Dec 2004 22:03:10 +0000
Subject: [PATCH 003/122] Bump release, strip off fedora.us prefix and dist
 tag.

---
 rkhunter.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 762568c..755cb70 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -5,7 +5,7 @@ AutoReqProv:    no
 
 Name:           rkhunter
 Version:        1.1.8
-Release:        0.fdr.1
+Release:        1
 Epoch:          0
 Summary:        Rootkit Hunter scans for rootkits, backdoors and local exploits.
 

From 08a72c00117ba01c18bc3b46cd0a51f93928930f Mon Sep 17 00:00:00 2001
From: Michael Schwendt <mschwendt@fedoraproject.org>
Date: Fri, 7 Jan 2005 08:31:35 +0000
Subject: [PATCH 004/122] auto-import rkhunter-1.1.9-1 on branch devel from
 rkhunter-1.1.9-1.src.rpm

---
 .cvsignore                                    |  2 +-
 ....src.md5 => rkhunter-1.1.9-0.fdr.1.src.md5 |  8 +--
 ... => rkhunter-1.1.9-app_check_default.patch |  9 ++--
 ...ch => rkhunter-1.1.9-prelink_cleanup.patch |  6 +--
 ... => rkhunter-1.1.9-shared_man_search.patch |  6 +--
 rkhunter.spec                                 | 49 ++++++++++---------
 sources                                       |  2 +-
 7 files changed, 42 insertions(+), 40 deletions(-)
 rename rkhunter-1.1.8-0.fdr.1.src.md5 => rkhunter-1.1.9-0.fdr.1.src.md5 (54%)
 rename rkhunter-1.1.8-app_check_default.patch => rkhunter-1.1.9-app_check_default.patch (82%)
 rename rkhunter-1.1.8-prelink_cleanup.patch => rkhunter-1.1.9-prelink_cleanup.patch (62%)
 rename rkhunter-1.1.8-shared_man_search.patch => rkhunter-1.1.9-shared_man_search.patch (69%)

diff --git a/.cvsignore b/.cvsignore
index 97678e9..40d5fcb 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,2 @@
-rkhunter-1.1.8.tar.gz
 rkhunter-scan_on_boot-rc.local.tar.gz
+rkhunter-1.1.9.tar.gz
diff --git a/rkhunter-1.1.8-0.fdr.1.src.md5 b/rkhunter-1.1.9-0.fdr.1.src.md5
similarity index 54%
rename from rkhunter-1.1.8-0.fdr.1.src.md5
rename to rkhunter-1.1.9-0.fdr.1.src.md5
index 1c16a44..c9d9ac7 100644
--- a/rkhunter-1.1.8-0.fdr.1.src.md5
+++ b/rkhunter-1.1.9-0.fdr.1.src.md5
@@ -1,7 +1,7 @@
-91cae6f04582fb0b27c96784ffe5adae  ../SOURCES/rkhunter-1.1.8.tar.gz
+2e24806cb1267124fba6132009e30f1b  ../SOURCES/rkhunter-1.1.9.tar.gz
 0728cef20dde6817c36ef5787286b6f6  ../SOURCES/rkhunter-scan_on_boot-rc.local.tar.gz
-4f749918a75c11e28efd235d363e9a6f  ../SOURCES/rkhunter-1.1.8-shared_man_search.patch
+22ad8521939744a7889d4fd8e6dad619  ../SOURCES/rkhunter-1.1.9-shared_man_search.patch
 b1525a7b472b96c669d6b7cd9048d6ed  ../SOURCES/rkhunter-1.1.8-showfiles.patch
 a76e5bcece252676355fd97b791f1000  ../SOURCES/rkhunter-1.1.8-whitelist_dir-conf.patch
-583368a65c82239fd1363f8cfa82a23a  ../SOURCES/rkhunter-1.1.8-app_check_default.patch
-a5cc9c9c8a7c91075dc2cfa9c370fc86  ../SOURCES/rkhunter-1.1.8-prelink_cleanup.patch
+7d2857462a1555dff41b467d6272b35d  ../SOURCES/rkhunter-1.1.9-app_check_default.patch
+2559461d3064ee82eda4d227c40a21d9  ../SOURCES/rkhunter-1.1.9-prelink_cleanup.patch
diff --git a/rkhunter-1.1.8-app_check_default.patch b/rkhunter-1.1.9-app_check_default.patch
similarity index 82%
rename from rkhunter-1.1.8-app_check_default.patch
rename to rkhunter-1.1.9-app_check_default.patch
index 9e9a311..6a6b06c 100644
--- a/rkhunter-1.1.8-app_check_default.patch
+++ b/rkhunter-1.1.9-app_check_default.patch
@@ -1,5 +1,5 @@
---- files/rkhunter.orig	2004-09-12 08:00:20.000000000 -0500
-+++ files/rkhunter	2004-10-11 13:57:59.000000000 -0500
+--- files/rkhunter.orig	2004-12-28 12:45:21.000000000 -0500
++++ files/rkhunter	2004-12-31 13:53:16.000000000 -0500
 @@ -49,7 +49,7 @@
  # Skip passwd/group check
  PASSWDCHECK_SKIP=0
@@ -7,8 +7,8 @@
 -APPLICATION_CHECK=1
 +APPLICATION_CHECK=0
  
+ USE_PATCHED_SOFTWARE=0
  
- if [ "`uname`" = "SunOS" ]; then
 @@ -186,6 +186,9 @@
            shift
  	  ROOTDIR=$1
@@ -19,12 +19,13 @@
        --scan-knownbad-files)
            PERFORMKNOWNBAD=1
            ;;
-@@ -4868,7 +4871,7 @@
+@@ -4957,7 +4960,8 @@
      echo $ECHOOPT "--report-mode*            : Don't show uninteresting information for reports"
      echo $ECHOOPT "--report-warnings-only*   : Show only warnings (lesser output than --report-mode,"
      echo $ECHOOPT "                            more than --quiet)"
 -    echo $ECHOOPT "--skip-application-check* : Don't run application version checks"
 +#    echo $ECHOOPT "--skip-application-check* : Don't run application version checks"
++    echo $ECHOOPT "--run-application-check*  : Run application version checks"
      echo $ECHOOPT "--skip-keypress*          : Don't wait after every test (non-interactive)"
      echo $ECHOOPT "--quick*                  : Perform quick scan (instead of full scan)"
      echo $ECHOOPT "--quiet*                  : Be quiet (only show warnings)"    
diff --git a/rkhunter-1.1.8-prelink_cleanup.patch b/rkhunter-1.1.9-prelink_cleanup.patch
similarity index 62%
rename from rkhunter-1.1.8-prelink_cleanup.patch
rename to rkhunter-1.1.9-prelink_cleanup.patch
index e79c65b..06efaab 100644
--- a/rkhunter-1.1.8-prelink_cleanup.patch
+++ b/rkhunter-1.1.9-prelink_cleanup.patch
@@ -1,6 +1,6 @@
---- files/rkhunter.orig	2004-09-12 08:00:20.000000000 -0500
-+++ files/rkhunter	2004-10-07 00:21:30.000000000 -0500
-@@ -2276,6 +2276,8 @@
+--- files/rkhunter.orig	2004-12-28 12:45:21.000000000 -0500
++++ files/rkhunter	2004-12-31 13:38:30.000000000 -0500
+@@ -2304,6 +2304,8 @@
  	  lastfile="${file}"
   
  	done
diff --git a/rkhunter-1.1.8-shared_man_search.patch b/rkhunter-1.1.9-shared_man_search.patch
similarity index 69%
rename from rkhunter-1.1.8-shared_man_search.patch
rename to rkhunter-1.1.9-shared_man_search.patch
index 8cd7ddc..5a55523 100644
--- a/rkhunter-1.1.8-shared_man_search.patch
+++ b/rkhunter-1.1.9-shared_man_search.patch
@@ -1,6 +1,6 @@
---- files/rkhunter.orig	2004-09-12 08:00:20.000000000 -0500
-+++ files/rkhunter	2004-09-27 23:47:08.000000000 -0500
-@@ -4045,7 +4045,7 @@
+--- files/rkhunter.orig	2004-12-28 12:45:21.000000000 -0500
++++ files/rkhunter	2004-12-31 13:25:53.000000000 -0500
+@@ -4127,7 +4127,7 @@
  	
  	displaytext -n "   Scanning for hidden files..."
  
diff --git a/rkhunter.spec b/rkhunter.spec
index 755cb70..6216f4f 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -4,7 +4,7 @@
 AutoReqProv:    no
 
 Name:           rkhunter
-Version:        1.1.8
+Version:        1.1.9
 Release:        1
 Epoch:          0
 Summary:        Rootkit Hunter scans for rootkits, backdoors and local exploits.
@@ -12,14 +12,14 @@ Summary:        Rootkit Hunter scans for rootkits, backdoors and local exploits.
 Group:          Applications/System
 License:        GPL
 URL:            http://www.rootkit.nl/
-Source0:        http://downloads.rootkit.nl/rkhunter-1.1.8.tar.gz
+Source0:        http://downloads.rootkit.nl/rkhunter-1.1.9.tar.gz
 Source1:        rkhunter-scan_on_boot-rc.local.tar.gz
-Source2:        rkhunter-1.1.8-0.fdr.1.src.md5
+Source2:        rkhunter-1.1.9-0.fdr.1.src.md5
 Patch1:         rkhunter-1.1.8-whitelist_dir-conf.patch
 Patch2:         rkhunter-1.1.8-showfiles.patch
-Patch3:         rkhunter-1.1.8-shared_man_search.patch
-Patch4:         rkhunter-1.1.8-app_check_default.patch
-Patch5:         rkhunter-1.1.8-prelink_cleanup.patch
+Patch3:         rkhunter-1.1.9-shared_man_search.patch
+Patch4:         rkhunter-1.1.9-app_check_default.patch
+Patch5:         rkhunter-1.1.9-prelink_cleanup.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -59,18 +59,21 @@ is free for everyone to use.
 
 %{__perl} -pi.orig -e '
 	s|\@RKLIB\@|%{_libdir}/%{name}|g;
-	s|\@RCDIR\@|%{_sysconfdir}/rc.d|g;
 	s|\@LGDIR\@|%{_localstatedir}/log|g;
-    ' rkhunter-scan_on_boot
-
-%{__perl} -pi.orig -e '
 	s|\@RCDIR\@|%{_sysconfdir}/rc.d|g;
 	s|\@ITDIR\@|%{_initrddir}|g;
 	s|\@SCDIR\@|%{_sysconfdir}/sysconfig|g;
 	s|\@RKEXE\@|%{_bindir}/%{name}|g;
-    ' rkhunter-scan_on_boot-rc.local
+    ' rkhunter-scan_on_boot \
+        rkhunter-scan_on_boot-rc.local
 
-%patch1 -b .orig
+%{__perl} -pi.orig -e '
+	s|^#$|INSTALLDIR=%{_prefix}|;
+	s|^#(TMPDIR=).+$|$1%{_var}/%{name}/tmp|;
+	s|^#(DBDIR=).+$|$1%{_var}/%{name}/db|;
+    ' files/%{name}.conf
+
+%patch1 -b .0001
 %patch2 -b .orig
 %patch3 -b .orig
 %patch4 -b .0001
@@ -86,16 +89,6 @@ RKHUNTER_FLAGS="
 "
 EOF
 
-%{__cat} <<'EOF' >%{name}.conf
-## Next three lines installed automatically by RPM. Do not change
-## unless you know what you're doing...
-INSTALLDIR=%{_prefix}
-DBDIR=%{_var}/%{name}/db
-TMPDIR=%{_var}/%{name}/tmp
-
-EOF
-%{__cat} files/%{name}.conf >> %{name}.conf
-
 %{__cat} <<'EOF' >01-%{name}
 #!/bin/sh
 %{_bindir}/%{name} --cronjob | /bin/mail -s '%{name} Daily Run' root
@@ -143,7 +136,7 @@ EOF
 %{__install} -m750 -p files/showfiles.pl        ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
 %{__install} -m750 -p 01-%{name}                ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/
 %{__install} -m750 -p rkhunter-scan_on_boot-rc.local ${RPM_BUILD_ROOT}%{_libdir}/%{name}/rc.d/rc.local
-%{__install} -m640 -p %{name}.conf              ${RPM_BUILD_ROOT}%{_sysconfdir}/
+%{__install} -m640 -p files/%{name}.conf        ${RPM_BUILD_ROOT}%{_sysconfdir}/
 %{__install} -m640 -p %{name}.sysconfig         ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name}
 
 
@@ -151,7 +144,7 @@ EOF
 %{__rm} -rf $RPM_BUILD_ROOT
 # Autoclean for rpmbuild -bb
 #cd ..
-#%{__rm} -rf %{name}
+#[ ! -d %{name} ] || %{__rm} -rf %{name}
 
 
 %postun
@@ -179,6 +172,14 @@ fi
 
 
 %changelog
+* Sun Jan 2 2005 Greg Houlette <tamaster@tekarmory.com> - 0:1.1.9-1
+- New package version release
+- Added the --run-application-check command line option
+  to listing in command help
+- Replaced 'Here' Doc editing of rkhunter.conf file
+  with in-place Perl edit
+- tweaked rpmbuild -bb Autoclean
+
 * Fri Oct 15 2004 Greg Houlette - 0:1.1.8-0.fdr.1 (revisited)
 - Removed redundant buildrequires /bin/sh, coreutils and perl
 - Revise postun scriptlet
diff --git a/sources b/sources
index 623f3a5..90b0870 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-91cae6f04582fb0b27c96784ffe5adae  rkhunter-1.1.8.tar.gz
 0728cef20dde6817c36ef5787286b6f6  rkhunter-scan_on_boot-rc.local.tar.gz
+2e24806cb1267124fba6132009e30f1b  rkhunter-1.1.9.tar.gz

From 669ace2a5168899a1c745b88b789b14ce0b81b9c Mon Sep 17 00:00:00 2001
From: Matthias Saou <thias@fedoraproject.org>
Date: Fri, 4 Mar 2005 00:05:42 +0000
Subject: [PATCH 005/122] Mass letter "q" and "r" update, one or more apply : -
 Drop epoch: 0 - Remove %{epoch} requirements in sub-packages - Remove
 trailing white spaces - Keep consistent between spaces and tabs

---
 rkhunter.spec | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 6216f4f..239cb4f 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -6,8 +6,7 @@ AutoReqProv:    no
 Name:           rkhunter
 Version:        1.1.9
 Release:        1
-Epoch:          0
-Summary:        Rootkit Hunter scans for rootkits, backdoors and local exploits.
+Summary:        Rootkit Hunter scans for rootkits, backdoors and local exploits
 
 Group:          Applications/System
 License:        GPL
@@ -50,7 +49,7 @@ is free for everyone to use.
 # DURING the binary build process (md5 canary check)
 #[ ! -e %{_sourcedir}/%{name}-%{version}-0.fdr.1.src.md5.orig ] \
 #    && %{__perl} -pi.orig -e '
-#	s|../SOURCES|%{_sourcedir}|g;
+#       s|../SOURCES|%{_sourcedir}|g;
 #     ' %{_sourcedir}/%{name}-%{version}-0.fdr.1.src.md5
 #md5sum --check %{_sourcedir}/%{name}-%{version}-0.fdr.1.src.md5 || exit $?
 
@@ -65,7 +64,7 @@ is free for everyone to use.
 	s|\@SCDIR\@|%{_sysconfdir}/sysconfig|g;
 	s|\@RKEXE\@|%{_bindir}/%{name}|g;
     ' rkhunter-scan_on_boot \
-        rkhunter-scan_on_boot-rc.local
+      rkhunter-scan_on_boot-rc.local
 
 %{__perl} -pi.orig -e '
 	s|^#$|INSTALLDIR=%{_prefix}|;
@@ -249,7 +248,7 @@ fi
 - added recursive remove of old build root as prep for install phase
 
 * Wed Apr 28 2004 Doncho N. Gunchev - 1.0.9-0.mr700
-- dropped Requires: perl - rkhunter works without it 
+- dropped Requires: perl - rkhunter works without it
 - dropped the bash alignpatch (check the source or contact me)
 - various file mode fixes (.../tmp/, *.db)
 - optimized the %%files section - any new files in the

From 7686a37e15adf130d7d8f0fd2a8fb5defbf68ea6 Mon Sep 17 00:00:00 2001
From: Michael Schwendt <mschwendt@fedoraproject.org>
Date: Wed, 6 Apr 2005 22:13:31 +0000
Subject: [PATCH 006/122] mass release bump for packages not rebuilt after
 FC-3-split

---
 rkhunter.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 239cb4f..221d705 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -5,7 +5,8 @@ AutoReqProv:    no
 
 Name:           rkhunter
 Version:        1.1.9
-Release:        1
+Release:        2
+
 Summary:        Rootkit Hunter scans for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -171,6 +172,9 @@ fi
 
 
 %changelog
+* Fri Apr  7 2005 Michael Schwendt <mschwendt[AT]users.sf.net>
+- rebuilt
+
 * Sun Jan 2 2005 Greg Houlette <tamaster@tekarmory.com> - 0:1.1.9-1
 - New package version release
 - Added the --run-application-check command line option

From e302934559aa5ffa9719f7c09c6b8eab07ce55ff Mon Sep 17 00:00:00 2001
From: tamaster <tamaster@fedoraproject.org>
Date: Thu, 5 Jan 2006 07:36:18 +0000
Subject: [PATCH 007/122] auto-import rkhunter-1.2.7-1 on branch devel from
 rkhunter-1.2.7-1.src.rpm

---
 .cvsignore                              |   4 +-
 rkhunter-1.1.8-whitelist_dir-conf.patch |  12 --
 rkhunter-1.1.9-0.fdr.1.src.md5          |   7 --
 rkhunter-1.1.9-prelink_cleanup.patch    |  11 --
 rkhunter-1.2.7-1.src.md5                |  10 ++
 rkhunter-1.2.7-append_log.patch         |  65 +++++++++++
 rkhunter-1.2.7-datestamp.patch          |  42 +++++++
 rkhunter-1.2.7-group_log.patch          |  11 ++
 rkhunter-1.2.7-install_dir-conf.patch   |  10 ++
 rkhunter-1.2.7-manpage.patch            |  38 ++++++
 rkhunter.spec                           | 146 ++++++++++++++----------
 sources                                 |   4 +-
 12 files changed, 263 insertions(+), 97 deletions(-)
 delete mode 100644 rkhunter-1.1.8-whitelist_dir-conf.patch
 delete mode 100644 rkhunter-1.1.9-0.fdr.1.src.md5
 delete mode 100644 rkhunter-1.1.9-prelink_cleanup.patch
 create mode 100644 rkhunter-1.2.7-1.src.md5
 create mode 100644 rkhunter-1.2.7-append_log.patch
 create mode 100644 rkhunter-1.2.7-datestamp.patch
 create mode 100644 rkhunter-1.2.7-group_log.patch
 create mode 100644 rkhunter-1.2.7-install_dir-conf.patch
 create mode 100644 rkhunter-1.2.7-manpage.patch

diff --git a/.cvsignore b/.cvsignore
index 40d5fcb..016fe66 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,2 @@
-rkhunter-scan_on_boot-rc.local.tar.gz
-rkhunter-1.1.9.tar.gz
+rkhunter-1.2.7.tar.gz
+rkhunter-auto_scan.tar.gz
diff --git a/rkhunter-1.1.8-whitelist_dir-conf.patch b/rkhunter-1.1.8-whitelist_dir-conf.patch
deleted file mode 100644
index 58bb2a1..0000000
--- a/rkhunter-1.1.8-whitelist_dir-conf.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- files/rkhunter.conf.orig	2004-08-20 10:02:59.000000000 -0500
-+++ files/rkhunter.conf	2004-09-27 23:47:08.000000000 -0500
-@@ -25,4 +25,7 @@
- #MD5WHITELIST=/bin/ps:9bd8bf260adc81d3a43a086fce6b430a
- #MD5WHITELIST=/bin/ps:404583a6b166c2f7ac1287445a9de6b3
- 
--# The End
-\ No newline at end of file
-+# Whitelist [hidden] directories
-+#ALLOWHIDDENDIR=/etc/.java
-+
-+# The End
diff --git a/rkhunter-1.1.9-0.fdr.1.src.md5 b/rkhunter-1.1.9-0.fdr.1.src.md5
deleted file mode 100644
index c9d9ac7..0000000
--- a/rkhunter-1.1.9-0.fdr.1.src.md5
+++ /dev/null
@@ -1,7 +0,0 @@
-2e24806cb1267124fba6132009e30f1b  ../SOURCES/rkhunter-1.1.9.tar.gz
-0728cef20dde6817c36ef5787286b6f6  ../SOURCES/rkhunter-scan_on_boot-rc.local.tar.gz
-22ad8521939744a7889d4fd8e6dad619  ../SOURCES/rkhunter-1.1.9-shared_man_search.patch
-b1525a7b472b96c669d6b7cd9048d6ed  ../SOURCES/rkhunter-1.1.8-showfiles.patch
-a76e5bcece252676355fd97b791f1000  ../SOURCES/rkhunter-1.1.8-whitelist_dir-conf.patch
-7d2857462a1555dff41b467d6272b35d  ../SOURCES/rkhunter-1.1.9-app_check_default.patch
-2559461d3064ee82eda4d227c40a21d9  ../SOURCES/rkhunter-1.1.9-prelink_cleanup.patch
diff --git a/rkhunter-1.1.9-prelink_cleanup.patch b/rkhunter-1.1.9-prelink_cleanup.patch
deleted file mode 100644
index 06efaab..0000000
--- a/rkhunter-1.1.9-prelink_cleanup.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- files/rkhunter.orig	2004-12-28 12:45:21.000000000 -0500
-+++ files/rkhunter	2004-12-31 13:38:30.000000000 -0500
-@@ -2304,6 +2304,8 @@
- 	  lastfile="${file}"
-  
- 	done
-+	
-+	[ -f ${TMPDIR}/prelink.tst ] && rm -f ${TMPDIR}/prelink.tst
- 
- 	if [ ${WARNING} -eq 1 ]; then
- 	  displaytext "--------------------------------------------------------------------------------"
diff --git a/rkhunter-1.2.7-1.src.md5 b/rkhunter-1.2.7-1.src.md5
new file mode 100644
index 0000000..0ac7270
--- /dev/null
+++ b/rkhunter-1.2.7-1.src.md5
@@ -0,0 +1,10 @@
+288ba8a87352716384823c9ea1958fa7  ../SOURCES/rkhunter-1.2.7.tar.gz
+a80c43eec631b565ca8b85e7ce9b8724  ../SOURCES/rkhunter-auto_scan.tar.gz
+b1525a7b472b96c669d6b7cd9048d6ed  ../SOURCES/rkhunter-1.1.8-showfiles.patch
+22ad8521939744a7889d4fd8e6dad619  ../SOURCES/rkhunter-1.1.9-shared_man_search.patch
+7d2857462a1555dff41b467d6272b35d  ../SOURCES/rkhunter-1.1.9-app_check_default.patch
+d9c7e1bcf14218bf45cef9e77fdb0c2a  ../SOURCES/rkhunter-1.2.7-install_dir-conf.patch
+2a33c05b180a792813776ee188c300a8  ../SOURCES/rkhunter-1.2.7-datestamp.patch
+7a8a7587b9781a94837978e15bd9766b  ../SOURCES/rkhunter-1.2.7-append_log.patch
+e9d8c6fa241a2fcae0dd99975fd343db  ../SOURCES/rkhunter-1.2.7-group_log.patch
+b13c7597610577a01fc6d612708d7ee4  ../SOURCES/rkhunter-1.2.7-manpage.patch
diff --git a/rkhunter-1.2.7-append_log.patch b/rkhunter-1.2.7-append_log.patch
new file mode 100644
index 0000000..96c40f8
--- /dev/null
+++ b/rkhunter-1.2.7-append_log.patch
@@ -0,0 +1,65 @@
+--- files/rkhunter.orig	2005-05-24 00:40:22.000000000 -0500
++++ files/rkhunter	2005-06-04 11:46:17.000000000 -0500
+@@ -35,9 +35,10 @@
+ CHECK=0
+ 
+ # Debugging
+-DEBUG=1
++DEBUG=0
+ DEBUGLOG=0
+ CATLOGFILE=0
++APPENDLOG=0
+ 
+ VERSIONCHECK=0
+ UPDATE=0
+@@ -136,6 +137,13 @@
+       --allow-ssh-root-user)
+           ALLOW_SSH_ROOT_USER="1"
+ 	  ;;
++      --append-log)
++          shift
++          DEBUGFILE=$1
++          DEBUGLOG=1
++          DEBUG=0
++          APPENDLOG=1
++	  ;;
+       -c | --checkall) 
+ 	  CHECK=1
+ 	  ;;
+@@ -235,18 +243,21 @@
+     # Through the drain...
+     DEBUGFILE="/dev/null"
+   else
+-    if [ -d "/var/log" ]
++    if [ "${DEBUGFILE}" = "" ]
+       then
+-        DEBUGFILE="/var/log/rkhunter.log"
+-      else
+-        echo "/var/log doesn't exists... no log file created"
+-	DEBUGFILE="/dev/null"
++        if [ -d "/var/log" ]
++          then
++            DEBUGFILE="/var/log/rkhunter.log"
++          else
++            echo "/var/log doesn't exists... no log file created"
++	    DEBUGFILE="/dev/null"
++        fi
+     fi
+     # Clear debug file
+-    if [ -f ${DEBUGFILE} ]; then
++    if [ ${APPENDLOG} -eq 0 -a -f ${DEBUGFILE} ]; then
+       rm -f ${DEBUGFILE}
++      touch ${DEBUGFILE}
+     fi
+-
+ fi
+ 
+ if [ "${DEBUGFILE}" = "" ]; then
+@@ -5060,6 +5071,7 @@
+     echo $ECHOOPT "--version                 : Show version and quit"
+     echo $ECHOOPT "--versioncheck            : Check for latest version"    
+     echo $ECHOOPT ""
++    echo $ECHOOPT "--append-log <file>*      : Append (instead of overwrite) logfile output to <file>"
+     echo $ECHOOPT "--bindir <bindir>*        : Use <bindir> instead of using default binaries"
+     echo $ECHOOPT "--configfile <file>*      : Use different configuration file"    
+     echo $ECHOOPT "--dbdir <dir>*            : Use <dbdir> as database directory"        
diff --git a/rkhunter-1.2.7-datestamp.patch b/rkhunter-1.2.7-datestamp.patch
new file mode 100644
index 0000000..08301db
--- /dev/null
+++ b/rkhunter-1.2.7-datestamp.patch
@@ -0,0 +1,42 @@
+--- files/rkhunter.orig	2005-05-24 00:40:22.000000000 -0500
++++ files/rkhunter	2005-05-29 15:20:25.000000000 -0500
+@@ -576,7 +576,7 @@
+ 
+ 
+ logtext "Running ${PROGRAM_NAME} ${PROGRAM_version} on ${hostname}"
+-logtext "${PROGRAM_license}"
++logtext "`date -R` ${PROGRAM_license}"
+ 
+ 
+ ##################################################################################################
+@@ -1687,7 +1687,7 @@
+   then
+     displaytext ""; displaytext "";
+     displaytext "${PROGRAM_NAME} ${PROGRAM_version} is running"
+-    displaytext ""
++    displaytext "`date -R`"
+     displaytext -n "Determining OS... "
+ 
+     if [ "${OPERATING_SYSTEM}" = "Darwin" ]
+@@ -4899,7 +4899,7 @@
+ 	    fi
+ 	  
+ 	    displaytext ""
+-	    displaytext "-----------------------------------------------------------------------"
++	    displaytext "------------------- `date -R` -------------------"
+ 	    displaytext ""
+ 	    displaytext "Do you have some problems, undetected rootkits, false positives, ideas"
+ 	    displaytext "or suggestions?"
+@@ -4981,10 +4981,10 @@
+ 
+ if [ "${UPDATE}" -eq 1 ]
+   then
+-    displaytext "Running updater..."
++    displaytext -e "\nRunning rkhunter updater... `date -R`"
+     displaytext ""
+     ${MYDIR}/lib/rkhunter/scripts/check_update.sh ${CONFIGFILE} ${MIRRORFILE} ${DB_PATH} ${md5} ${DEBUGFILE}
+-    displaytext ""
++    displaytext "Finished rkhunter updater.. `date -R`"
+     displaytext "Ready."
+ fi
+ 
diff --git a/rkhunter-1.2.7-group_log.patch b/rkhunter-1.2.7-group_log.patch
new file mode 100644
index 0000000..83cfe64
--- /dev/null
+++ b/rkhunter-1.2.7-group_log.patch
@@ -0,0 +1,11 @@
+--- files/rkhunter.orig	2005-05-24 00:40:22.000000000 -0500
++++ files/rkhunter	2005-05-31 22:41:52.000000000 -0500
+@@ -3979,7 +3979,7 @@
+ 		cp /etc/group ${TMPDIR}/group
+ 	      else
+ 	        displaytext "${BAD}Error. ${NORMAL}Cannot find /etc/group"
+-		logtext "Can't find /etc/passwd file?!?"
++		logtext "Can't find /etc/group file?!?"
+ 	    fi
+         fi
+ 
diff --git a/rkhunter-1.2.7-install_dir-conf.patch b/rkhunter-1.2.7-install_dir-conf.patch
new file mode 100644
index 0000000..c406177
--- /dev/null
+++ b/rkhunter-1.2.7-install_dir-conf.patch
@@ -0,0 +1,10 @@
+--- files/rkhunter.conf.orig	2005-03-19 12:27:20.000000000 -0500
++++ files/rkhunter.conf	2005-05-29 12:48:32.000000000 -0500
+@@ -3,6 +3,7 @@
+ #
+ # All lines beginning with a dash (#) or empty lines, will be ignored.
+ #
++#INSTALLDIR=/usr/local
+ 
+ # Links to files. Don't change if you don't need to.
+ LATESTVERSION=/rkhunter_latest.dat
diff --git a/rkhunter-1.2.7-manpage.patch b/rkhunter-1.2.7-manpage.patch
new file mode 100644
index 0000000..8d989f1
--- /dev/null
+++ b/rkhunter-1.2.7-manpage.patch
@@ -0,0 +1,38 @@
+--- files/development/rkhunter.8.orig	2005-03-19 07:10:16.000000000 -0500
++++ files/development/rkhunter.8	2005-06-05 11:37:23.000000000 -0500
+@@ -13,7 +13,8 @@
+ 
+ 
+ \fBrkhunter\fP [-c|--checkall] [--createlogfile] [--cronjob] 
+-[--disable-md5-check] [--nocolors] [--versioncheck]
++[--disable-md5-check] [--help] [--nocolors] [--run-application-check]
++[--update] [--versioncheck]
+ .fam T
+ .fi
+ .SH DESCRIPTION
+@@ -101,6 +102,12 @@
+ Changes the default root directory, for chroot environments.
+ .TP
+ .B
++--run-application-check
++Finds and checks various significant applications for downrev 
++versions (with possible vulnerabilities) and recommends their 
++update to more recent versions.
++.TP
++.B
+ --tmpdir
+ Changes the default directory for temporary storage
+ .TP
+@@ -109,6 +116,12 @@
+ Make rkhunter non-interactive
+ .TP
+ .B
++--update
++Checks the \fBrkhunter\fP mirror list to determine if any newer 
++versions of the file signature database files are available for 
++download.  Should be run often.
++.TP
++.B
+ --versioncheck
+ Consults the \fBrkhunter\fP website to determine if a newer 
+ version is available for download. Uses wget. The latest version
diff --git a/rkhunter.spec b/rkhunter.spec
index 221d705..6f78c74 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -4,32 +4,36 @@
 AutoReqProv:    no
 
 Name:           rkhunter
-Version:        1.1.9
-Release:        2
-
-Summary:        Rootkit Hunter scans for rootkits, backdoors and local exploits
+Version:        1.2.7
+Release:        1
+Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
 License:        GPL
 URL:            http://www.rootkit.nl/
-Source0:        http://downloads.rootkit.nl/rkhunter-1.1.9.tar.gz
-Source1:        rkhunter-scan_on_boot-rc.local.tar.gz
-Source2:        rkhunter-1.1.9-0.fdr.1.src.md5
-Patch1:         rkhunter-1.1.8-whitelist_dir-conf.patch
-Patch2:         rkhunter-1.1.8-showfiles.patch
-Patch3:         rkhunter-1.1.9-shared_man_search.patch
-Patch4:         rkhunter-1.1.9-app_check_default.patch
-Patch5:         rkhunter-1.1.9-prelink_cleanup.patch
+Source0:        http://downloads.rootkit.nl/rkhunter-1.2.7.tar.gz
+Source1:        rkhunter-auto_scan.tar.gz
+Source2:        rkhunter-%{version}-%{release}.src.md5
+Patch0:         rkhunter-1.2.7-install_dir-conf.patch
+Patch1:         rkhunter-1.1.8-showfiles.patch
+Patch2:         rkhunter-1.1.9-shared_man_search.patch
+Patch3:         rkhunter-1.1.9-app_check_default.patch
+Patch4:         rkhunter-1.2.7-datestamp.patch
+Patch5:         rkhunter-1.2.7-append_log.patch
+Patch6:         rkhunter-1.2.7-group_log.patch
+Patch7:         rkhunter-1.2.7-manpage.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
-Requires:       /bin/sh, coreutils, binutils, modutils, findutils, grep
-Requires:       e2fsprogs, procps, lsof, prelink, iproute, net-tools
-Requires:       perl, perl(strict), perl(IO::Socket), nmap, mailx
+Requires:       /bin/sh, coreutils, binutils, modutils, findutils, grep, mktemp
+Requires:       e2fsprogs, procps, lsof, prelink, iproute, net-tools, wget
+Requires:       perl, perl(strict), perl(IO::Socket), mailx
 
 %description
-Rootkit Hunter is a scanning tool to ensure that you're about 99.9%%
-clean of nasty tools.  This tool scans for rootkits, backdoors and local
+Rootkit Hunter scans files and systems for known and unknown rootkits,
+backdoors, and sniffers.  The package contains one shell script, a few
+text-based databases, and optional Perl modules.  It should run on almost
+every Unix clone.  This tool scans for rootkits, backdoors and local
 exploits by running tests like:
         - MD5 hash compare
         - Look for default files used by rootkits
@@ -48,50 +52,52 @@ is free for everyone to use.
 
 # This optional check is for verification of original sources
 # DURING the binary build process (md5 canary check)
-#[ ! -e %{_sourcedir}/%{name}-%{version}-0.fdr.1.src.md5.orig ] \
-#    && %{__perl} -pi.orig -e '
-#       s|../SOURCES|%{_sourcedir}|g;
-#     ' %{_sourcedir}/%{name}-%{version}-0.fdr.1.src.md5
-#md5sum --check %{_sourcedir}/%{name}-%{version}-0.fdr.1.src.md5 || exit $?
+[ ! -e %{_sourcedir}/%{name}-%{version}-%{release}.src.md5.orig ] \
+    && %{__perl} -pi.orig -e '
+	s|../SOURCES|%{_sourcedir}|g;
+     ' %{_sourcedir}/%{name}-%{version}-%{release}.src.md5
+md5sum --check %{_sourcedir}/%{name}-%{version}-%{release}.src.md5 || exit $?
+%{__rm} -f %{_sourcedir}/%{name}-%{version}-%{release}.src.md5
+%{__mv} %{_sourcedir}/%{name}-%{version}-%{release}.src.md5.orig \
+        %{_sourcedir}/%{name}-%{version}-%{release}.src.md5
 
 %setup -q -n %{name}
 %setup -q -D -T -a 1 -n %{name}
 
-%{__perl} -pi.orig -e '
-	s|\@RKLIB\@|%{_libdir}/%{name}|g;
-	s|\@LGDIR\@|%{_localstatedir}/log|g;
-	s|\@RCDIR\@|%{_sysconfdir}/rc.d|g;
-	s|\@ITDIR\@|%{_initrddir}|g;
-	s|\@SCDIR\@|%{_sysconfdir}/sysconfig|g;
-	s|\@RKEXE\@|%{_bindir}/%{name}|g;
-    ' rkhunter-scan_on_boot \
-      rkhunter-scan_on_boot-rc.local
+%patch0 -b .orig
 
-%{__perl} -pi.orig -e '
-	s|^#$|INSTALLDIR=%{_prefix}|;
+%{__perl} -pi.0001 -e '
+	s|^#(INSTALLDIR=).+$|$1%{_prefix}|;
+	s|^#(MAIL-ON-WARNING=).+$|$1root\@localhost|;
 	s|^#(TMPDIR=).+$|$1%{_var}/%{name}/tmp|;
 	s|^#(DBDIR=).+$|$1%{_var}/%{name}/db|;
     ' files/%{name}.conf
 
-%patch1 -b .0001
+%{__perl} -pi.orig -e '
+	s|\@TMPDIR\@|%{_var}/%{name}/tmp|g;
+	s|\@STDIR\@|%{_localstatedir}|g;
+	s|\@CFGDIR\@|%{_sysconfdir}|g;
+	s|\@SCDIR\@|%{_sysconfdir}/sysconfig|g;
+	s|\@ITDIR\@|%{_initrddir}|g;
+	s|\@RKEXE\@|%{_bindir}/%{name}|g;
+	s|\@RKHSH\@|%{_bindir}/%{name}-scan.sh|g;
+	s|\@LGDIR\@|%{_localstatedir}/log|g;
+    ' 01-%{name}
+
+%patch1 -b .orig
 %patch2 -b .orig
-%patch3 -b .orig
-%patch4 -b .0001
-%patch5 -b .0002
+%patch3 -b .0001
+%patch4 -b .0002
+%patch5 -b .0003
+%patch6 -b .0004
+%patch7 -b .orig
 
-%{__cat} <<'EOF' >%{name}.sysconfig
-# System configuration file for Rootkit Hunter which
-# stores RPM system specifics for rc.local, etc.
-
-RKHUNTER_FLAGS="
-    --quiet
-    --create-logfile
-"
-EOF
-
-%{__cat} <<'EOF' >01-%{name}
-#!/bin/sh
-%{_bindir}/%{name} --cronjob | /bin/mail -s '%{name} Daily Run' root
+%{__cat} <<'EOF' >%{name}.logrotate
+%{_localstatedir}/log/%{name}.log {
+    weekly
+    notifempty
+    create 640 root root
+}
 EOF
 
 
@@ -101,11 +107,11 @@ EOF
 
 
 %install
-%{__rm} -rf ${RPM_BUILD_ROOT}
+%{__rm} -rf $RPM_BUILD_ROOT
 
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_bindir}
-%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_sysconfdir}/{cron.daily,sysconfig}
-%{__mkdir} -m750 -p ${RPM_BUILD_ROOT}%{_libdir}/%{name}/{scripts,rc.d}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_sysconfdir}/{cron.daily,sysconfig,logrotate.d}
+%{__mkdir} -m750 -p ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8
 %{__mkdir} -m750 -p ${RPM_BUILD_ROOT}%{_var}/%{name}/{db,tmp}
@@ -124,7 +130,6 @@ EOF
 %{__install} -m644 -p files/LICENSE             ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
 %{__install} -m644 -p files/README              ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
 %{__install} -m644 -p files/WISHLIST            ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
-%{__install} -m644 -p rkhunter-scan_on_boot     ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/BOOTSCAN
 
 %{__install} -m644 -p files/development/*.8     ${RPM_BUILD_ROOT}%{_mandir}/man8/
 
@@ -135,7 +140,7 @@ EOF
 %{__install} -m750 -p files/filehashsha1.pl     ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
 %{__install} -m750 -p files/showfiles.pl        ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
 %{__install} -m750 -p 01-%{name}                ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/
-%{__install} -m750 -p rkhunter-scan_on_boot-rc.local ${RPM_BUILD_ROOT}%{_libdir}/%{name}/rc.d/rc.local
+%{__install} -m644 -p %{name}.logrotate         ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/%{name}
 %{__install} -m640 -p files/%{name}.conf        ${RPM_BUILD_ROOT}%{_sysconfdir}/
 %{__install} -m640 -p %{name}.sysconfig         ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name}
 
@@ -143,10 +148,20 @@ EOF
 %clean
 %{__rm} -rf $RPM_BUILD_ROOT
 # Autoclean for rpmbuild -bb
-#cd ..
-#[ ! -d %{name} ] || %{__rm} -rf %{name}
+cd ..
+[ ! -d %{name} ] || %{__rm} -rf %{name}
 
 
+%post
+/bin/touch %{_localstatedir}/log/%{name}.log
+/bin/echo -e "------------------- `/bin/date -R` -------------------\n" \
+  >> %{_localstatedir}/log/%{name}.log
+%{_bindir}/%{name} --version >> %{_localstatedir}/log/%{name}.log
+/bin/echo -e "\n------------------------------ Installed ------------------------------\n" \
+  >> %{_localstatedir}/log/%{name}.log
+/bin/chown root.root %{_localstatedir}/log/%{name}.log
+/bin/chmod 640 %{_localstatedir}/log/%{name}.log
+
 %postun
 if [ "$1" = 0 ]; then
     [ ! -d %{_var}/%{name} ] || %{__rm} -rf %{_var}/%{name}
@@ -159,21 +174,26 @@ fi
 %{_bindir}/%{name}
 %dir %{_libdir}/%{name}
 %{_libdir}/%{name}/scripts
-%{_libdir}/%{name}/rc.d
 %{_sysconfdir}/cron.daily/01-%{name}
+%{_sysconfdir}/logrotate.d/%{name}
 %dir %{_var}/%{name}
 %{_var}/%{name}/db
 %dir %{_var}/%{name}/tmp
-%config(noreplace) %{_sysconfdir}/%{name}.conf
-%config(noreplace) %{_sysconfdir}/sysconfig/%{name}
+%{_sysconfdir}/%{name}.conf
+%{_sysconfdir}/sysconfig/%{name}
 %dir %{_docdir}/%{name}-%{version}
 %doc %{_docdir}/%{name}-%{version}/*
 %{_mandir}/man8/*
 
 
 %changelog
-* Fri Apr  7 2005 Michael Schwendt <mschwendt[AT]users.sf.net>
-- rebuilt
+* Mon Jun 11 2005 Greg Houlette <tamaster@pobox.com> - 1.2.7-1
+- Added signature auto-updating to CRON scan (new script)
+- Removed BOOTSCAN pending rewrite to full SysV Init scan in background
+- Added the --append-log command line option
+- Added Date Stamping to output
+- Fixed bug in /etc/group missing report
+- New package version release
 
 * Sun Jan 2 2005 Greg Houlette <tamaster@tekarmory.com> - 0:1.1.9-1
 - New package version release
@@ -252,7 +272,7 @@ fi
 - added recursive remove of old build root as prep for install phase
 
 * Wed Apr 28 2004 Doncho N. Gunchev - 1.0.9-0.mr700
-- dropped Requires: perl - rkhunter works without it
+- dropped Requires: perl - rkhunter works without it 
 - dropped the bash alignpatch (check the source or contact me)
 - various file mode fixes (.../tmp/, *.db)
 - optimized the %%files section - any new files in the
diff --git a/sources b/sources
index 90b0870..ce91479 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-0728cef20dde6817c36ef5787286b6f6  rkhunter-scan_on_boot-rc.local.tar.gz
-2e24806cb1267124fba6132009e30f1b  rkhunter-1.1.9.tar.gz
+288ba8a87352716384823c9ea1958fa7  rkhunter-1.2.7.tar.gz
+a80c43eec631b565ca8b85e7ce9b8724  rkhunter-auto_scan.tar.gz

From 43137d9d07669db8aa3c761ef5e78347a2daafab Mon Sep 17 00:00:00 2001
From: tamaster <tamaster@fedoraproject.org>
Date: Sat, 11 Mar 2006 21:08:16 +0000
Subject: [PATCH 008/122] - New package version release - reworked the .spec
 file to support optional dist tag - Updated the application check default
 patchfile (chunk failure) - Changed to SHA1 for optional message digest
 (canary check) - Added a couple of suggested skip entries to rkhunter.conf

---
 .cvsignore                                    |  3 +-
 rkhunter-1.2.7-1.src.md5                      | 10 -----
 rkhunter-1.2.7-install_dir-conf.patch         | 10 -----
 rkhunter-1.2.8-1.src.sha                      | 10 +++++
 ... => rkhunter-1.2.8-app_check_default.patch | 12 ++---
 rkhunter-1.2.8-default_settings-conf.patch    | 24 ++++++++++
 rkhunter.spec                                 | 44 ++++++++++++-------
 sources                                       |  2 +-
 8 files changed, 70 insertions(+), 45 deletions(-)
 delete mode 100644 rkhunter-1.2.7-1.src.md5
 delete mode 100644 rkhunter-1.2.7-install_dir-conf.patch
 create mode 100644 rkhunter-1.2.8-1.src.sha
 rename rkhunter-1.1.9-app_check_default.patch => rkhunter-1.2.8-app_check_default.patch (81%)
 create mode 100644 rkhunter-1.2.8-default_settings-conf.patch

diff --git a/.cvsignore b/.cvsignore
index 016fe66..8c03507 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,2 +1,3 @@
-rkhunter-1.2.7.tar.gz
+rkhunter-1.2.8.tar.gz
 rkhunter-auto_scan.tar.gz
+clog
diff --git a/rkhunter-1.2.7-1.src.md5 b/rkhunter-1.2.7-1.src.md5
deleted file mode 100644
index 0ac7270..0000000
--- a/rkhunter-1.2.7-1.src.md5
+++ /dev/null
@@ -1,10 +0,0 @@
-288ba8a87352716384823c9ea1958fa7  ../SOURCES/rkhunter-1.2.7.tar.gz
-a80c43eec631b565ca8b85e7ce9b8724  ../SOURCES/rkhunter-auto_scan.tar.gz
-b1525a7b472b96c669d6b7cd9048d6ed  ../SOURCES/rkhunter-1.1.8-showfiles.patch
-22ad8521939744a7889d4fd8e6dad619  ../SOURCES/rkhunter-1.1.9-shared_man_search.patch
-7d2857462a1555dff41b467d6272b35d  ../SOURCES/rkhunter-1.1.9-app_check_default.patch
-d9c7e1bcf14218bf45cef9e77fdb0c2a  ../SOURCES/rkhunter-1.2.7-install_dir-conf.patch
-2a33c05b180a792813776ee188c300a8  ../SOURCES/rkhunter-1.2.7-datestamp.patch
-7a8a7587b9781a94837978e15bd9766b  ../SOURCES/rkhunter-1.2.7-append_log.patch
-e9d8c6fa241a2fcae0dd99975fd343db  ../SOURCES/rkhunter-1.2.7-group_log.patch
-b13c7597610577a01fc6d612708d7ee4  ../SOURCES/rkhunter-1.2.7-manpage.patch
diff --git a/rkhunter-1.2.7-install_dir-conf.patch b/rkhunter-1.2.7-install_dir-conf.patch
deleted file mode 100644
index c406177..0000000
--- a/rkhunter-1.2.7-install_dir-conf.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- files/rkhunter.conf.orig	2005-03-19 12:27:20.000000000 -0500
-+++ files/rkhunter.conf	2005-05-29 12:48:32.000000000 -0500
-@@ -3,6 +3,7 @@
- #
- # All lines beginning with a dash (#) or empty lines, will be ignored.
- #
-+#INSTALLDIR=/usr/local
- 
- # Links to files. Don't change if you don't need to.
- LATESTVERSION=/rkhunter_latest.dat
diff --git a/rkhunter-1.2.8-1.src.sha b/rkhunter-1.2.8-1.src.sha
new file mode 100644
index 0000000..5761c82
--- /dev/null
+++ b/rkhunter-1.2.8-1.src.sha
@@ -0,0 +1,10 @@
+1a882ef4351214facffcad1d5c0e7acf1a9d875b  ../SOURCES/rkhunter-1.2.8.tar.gz
+7e050d1a82a060b77943d3f7ccd82982d41f1ec3  ../SOURCES/rkhunter-auto_scan.tar.gz
+7f60ea47f064ab28ae40b7ffc8a62a68a7b14735  ../SOURCES/rkhunter-1.1.8-showfiles.patch
+4e43e6566ff748ac355aac0cde9643d8173c03be  ../SOURCES/rkhunter-1.1.9-shared_man_search.patch
+1058f002585440a9d53c7dbd4a4e4cf2778c0f21  ../SOURCES/rkhunter-1.2.7-datestamp.patch
+ad40550fab9ada953546a83ab56586ffd183a160  ../SOURCES/rkhunter-1.2.7-append_log.patch
+80148ca917ecd3117e1e2cf03237f188fa3632e7  ../SOURCES/rkhunter-1.2.7-group_log.patch
+fbf80a4343c0be375a744215bf5b834f23734525  ../SOURCES/rkhunter-1.2.7-manpage.patch
+f72d92d220edeaaaddc40155a22a2b4bc7d81b82  ../SOURCES/rkhunter-1.2.8-app_check_default.patch
+85a6bc95f36a8aa5c2f5aee0b0ab6f749d450c9d  ../SOURCES/rkhunter-1.2.8-default_settings-conf.patch
diff --git a/rkhunter-1.1.9-app_check_default.patch b/rkhunter-1.2.8-app_check_default.patch
similarity index 81%
rename from rkhunter-1.1.9-app_check_default.patch
rename to rkhunter-1.2.8-app_check_default.patch
index 6a6b06c..84fdeb0 100644
--- a/rkhunter-1.1.9-app_check_default.patch
+++ b/rkhunter-1.2.8-app_check_default.patch
@@ -1,5 +1,5 @@
---- files/rkhunter.orig	2004-12-28 12:45:21.000000000 -0500
-+++ files/rkhunter	2004-12-31 13:53:16.000000000 -0500
+--- files/rkhunter.orig	2006-02-14 05:35:20.000000000 -0500
++++ files/rkhunter	2006-03-05 14:20:37.000000000 -0500
 @@ -49,7 +49,7 @@
  # Skip passwd/group check
  PASSWDCHECK_SKIP=0
@@ -7,9 +7,9 @@
 -APPLICATION_CHECK=1
 +APPLICATION_CHECK=0
  
+ # Patched software versions?
  USE_PATCHED_SOFTWARE=0
- 
-@@ -186,6 +186,9 @@
+@@ -196,6 +196,9 @@
            shift
  	  ROOTDIR=$1
            ;;
@@ -19,13 +19,13 @@
        --scan-knownbad-files)
            PERFORMKNOWNBAD=1
            ;;
-@@ -4957,7 +4960,8 @@
+@@ -5053,7 +5056,8 @@
      echo $ECHOOPT "--report-mode*            : Don't show uninteresting information for reports"
      echo $ECHOOPT "--report-warnings-only*   : Show only warnings (lesser output than --report-mode,"
      echo $ECHOOPT "                            more than --quiet)"
 -    echo $ECHOOPT "--skip-application-check* : Don't run application version checks"
 +#    echo $ECHOOPT "--skip-application-check* : Don't run application version checks"
 +    echo $ECHOOPT "--run-application-check*  : Run application version checks"
-     echo $ECHOOPT "--skip-keypress*          : Don't wait after every test (non-interactive)"
+     echo $ECHOOPT "--skip-keypress (-sk)*    : Don't wait after every test (non-interactive)"
      echo $ECHOOPT "--quick*                  : Perform quick scan (instead of full scan)"
      echo $ECHOOPT "--quiet*                  : Be quiet (only show warnings)"    
diff --git a/rkhunter-1.2.8-default_settings-conf.patch b/rkhunter-1.2.8-default_settings-conf.patch
new file mode 100644
index 0000000..fd392d7
--- /dev/null
+++ b/rkhunter-1.2.8-default_settings-conf.patch
@@ -0,0 +1,24 @@
+--- files/rkhunter.conf.orig	2005-03-19 12:27:20.000000000 -0500
++++ files/rkhunter.conf	2006-03-06 06:17:26.000000000 -0500
+@@ -3,6 +3,7 @@
+ #
+ # All lines beginning with a dash (#) or empty lines, will be ignored.
+ #
++#INSTALLDIR=/usr/local
+ 
+ # Links to files. Don't change if you don't need to.
+ LATESTVERSION=/rkhunter_latest.dat
+@@ -37,11 +38,12 @@
+ # Allow hidden directory
+ # One directory per line (use multiple ALLOWHIDDENDIR lines)
+ #
++#ALLOWHIDDENDIR=/dev/.udevdb
+ #ALLOWHIDDENDIR=/etc/.java
+ 
+ # Allow hidden file
+ # One file per line (use multiple ALLOWHIDDENFILE lines)
+ # 
+-#ALLOWHIDDENFILE=/etc/.java
++#ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
+ 
+ # The End
diff --git a/rkhunter.spec b/rkhunter.spec
index 6f78c74..504f960 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,23 +1,26 @@
+%define rkhVer 1.2.8
+%define rpmRel 1
+
 # We can't let RPM do the dependencies automatic because it'll then pick up
 # a correct but undesirable perl dependency, which rkhunter does not require
 # in order to function properly [perl(Digest::MD5) & perl(Digest::SHA1)].
 AutoReqProv:    no
 
 Name:           rkhunter
-Version:        1.2.7
-Release:        1
+Version:        %{rkhVer}
+Release:        %{rpmRel}%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
 License:        GPL
 URL:            http://www.rootkit.nl/
-Source0:        http://downloads.rootkit.nl/rkhunter-1.2.7.tar.gz
+Source0:        http://downloads.rootkit.nl/rkhunter-1.2.8.tar.gz
 Source1:        rkhunter-auto_scan.tar.gz
-Source2:        rkhunter-%{version}-%{release}.src.md5
-Patch0:         rkhunter-1.2.7-install_dir-conf.patch
+Source2:        rkhunter-%{rkhVer}-%{rpmRel}.src.sha
+Patch0:         rkhunter-1.2.8-default_settings-conf.patch
 Patch1:         rkhunter-1.1.8-showfiles.patch
 Patch2:         rkhunter-1.1.9-shared_man_search.patch
-Patch3:         rkhunter-1.1.9-app_check_default.patch
+Patch3:         rkhunter-1.2.8-app_check_default.patch
 Patch4:         rkhunter-1.2.7-datestamp.patch
 Patch5:         rkhunter-1.2.7-append_log.patch
 Patch6:         rkhunter-1.2.7-group_log.patch
@@ -51,15 +54,15 @@ is free for everyone to use.
 %prep
 
 # This optional check is for verification of original sources
-# DURING the binary build process (md5 canary check)
-[ ! -e %{_sourcedir}/%{name}-%{version}-%{release}.src.md5.orig ] \
-    && %{__perl} -pi.orig -e '
-	s|../SOURCES|%{_sourcedir}|g;
-     ' %{_sourcedir}/%{name}-%{version}-%{release}.src.md5
-md5sum --check %{_sourcedir}/%{name}-%{version}-%{release}.src.md5 || exit $?
-%{__rm} -f %{_sourcedir}/%{name}-%{version}-%{release}.src.md5
-%{__mv} %{_sourcedir}/%{name}-%{version}-%{release}.src.md5.orig \
-        %{_sourcedir}/%{name}-%{version}-%{release}.src.md5
+# DURING the binary build process (sha1 canary check)
+#[ ! -e %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha.orig ] \
+#    && %{__perl} -pi.orig -e '
+#	s|../SOURCES|%{_sourcedir}|g;
+#     ' %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha
+#sha1sum --check %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha || exit $?
+#%{__rm} -f %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha
+#%{__mv} %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha.orig \
+#        %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha
 
 %setup -q -n %{name}
 %setup -q -D -T -a 1 -n %{name}
@@ -148,8 +151,8 @@ EOF
 %clean
 %{__rm} -rf $RPM_BUILD_ROOT
 # Autoclean for rpmbuild -bb
-cd ..
-[ ! -d %{name} ] || %{__rm} -rf %{name}
+#cd ..
+#[ ! -d %{name} ] || %{__rm} -rf %{name}
 
 
 %post
@@ -187,6 +190,13 @@ fi
 
 
 %changelog
+* Tue Mar 7 2006 Greg Houlette <tamaster@pobox.com> - 1.2.8-1
+- New package version release
+- reworked the .spec file to support optional dist tag
+- Updated the application check default patchfile (chunk failure)
+- Changed to SHA1 for optional message digest (canary check)
+- Added a couple of suggested skip entries to rkhunter.conf
+
 * Mon Jun 11 2005 Greg Houlette <tamaster@pobox.com> - 1.2.7-1
 - Added signature auto-updating to CRON scan (new script)
 - Removed BOOTSCAN pending rewrite to full SysV Init scan in background
diff --git a/sources b/sources
index ce91479..595f274 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-288ba8a87352716384823c9ea1958fa7  rkhunter-1.2.7.tar.gz
+41122193b5006b617e03c637a17ae982  rkhunter-1.2.8.tar.gz
 a80c43eec631b565ca8b85e7ce9b8724  rkhunter-auto_scan.tar.gz

From ed7d0b677cf5e063de93fa8bccbc6614a0fb0ba9 Mon Sep 17 00:00:00 2001
From: tamaster <tamaster@fedoraproject.org>
Date: Fri, 17 Mar 2006 13:01:00 +0000
Subject: [PATCH 009/122] - Fixed architectural dependency during package
 creation eliminating use of     _libdir configure macro (x86_64 /usr/lib64
 mis-targeting)

---
 ....2.8-1.src.sha => rkhunter-1.2.8-2.src.sha |  0
 rkhunter.spec                                 | 26 +++++++++++--------
 2 files changed, 15 insertions(+), 11 deletions(-)
 rename rkhunter-1.2.8-1.src.sha => rkhunter-1.2.8-2.src.sha (100%)

diff --git a/rkhunter-1.2.8-1.src.sha b/rkhunter-1.2.8-2.src.sha
similarity index 100%
rename from rkhunter-1.2.8-1.src.sha
rename to rkhunter-1.2.8-2.src.sha
diff --git a/rkhunter.spec b/rkhunter.spec
index 504f960..a4e63d6 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,5 +1,5 @@
 %define rkhVer 1.2.8
-%define rpmRel 1
+%define rpmRel 2
 
 # We can't let RPM do the dependencies automatic because it'll then pick up
 # a correct but undesirable perl dependency, which rkhunter does not require
@@ -114,7 +114,7 @@ EOF
 
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_bindir}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_sysconfdir}/{cron.daily,sysconfig,logrotate.d}
-%{__mkdir} -m750 -p ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts
+%{__mkdir} -m750 -p ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8
 %{__mkdir} -m750 -p ${RPM_BUILD_ROOT}%{_var}/%{name}/{db,tmp}
@@ -136,12 +136,12 @@ EOF
 
 %{__install} -m644 -p files/development/*.8     ${RPM_BUILD_ROOT}%{_mandir}/man8/
 
-%{__install} -m750 -p files/check_modules.pl    ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
-%{__install} -m750 -p files/check_port.pl       ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
-%{__install} -m750 -p files/check_update.sh     ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
-%{__install} -m750 -p files/filehashmd5.pl      ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
-%{__install} -m750 -p files/filehashsha1.pl     ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
-%{__install} -m750 -p files/showfiles.pl        ${RPM_BUILD_ROOT}%{_libdir}/%{name}/scripts/
+%{__install} -m750 -p files/check_modules.pl    ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
+%{__install} -m750 -p files/check_port.pl       ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
+%{__install} -m750 -p files/check_update.sh     ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
+%{__install} -m750 -p files/filehashmd5.pl      ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
+%{__install} -m750 -p files/filehashsha1.pl     ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
+%{__install} -m750 -p files/showfiles.pl        ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
 %{__install} -m750 -p 01-%{name}                ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/
 %{__install} -m644 -p %{name}.logrotate         ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/%{name}
 %{__install} -m640 -p files/%{name}.conf        ${RPM_BUILD_ROOT}%{_sysconfdir}/
@@ -168,15 +168,15 @@ EOF
 %postun
 if [ "$1" = 0 ]; then
     [ ! -d %{_var}/%{name} ] || %{__rm} -rf %{_var}/%{name}
-    [ ! -d %{_libdir}/%{name} ] || %{__rm} -rf %{_libdir}/%{name}
+    [ ! -d %{_prefix}/lib/%{name} ] || %{__rm} -rf %{_prefix}/lib/%{name}
 fi
 
 
 %files
 %defattr(-,root,root,-)
 %{_bindir}/%{name}
-%dir %{_libdir}/%{name}
-%{_libdir}/%{name}/scripts
+%dir %{_prefix}/lib/%{name}
+%{_prefix}/lib/%{name}/scripts
 %{_sysconfdir}/cron.daily/01-%{name}
 %{_sysconfdir}/logrotate.d/%{name}
 %dir %{_var}/%{name}
@@ -190,6 +190,10 @@ fi
 
 
 %changelog
+* Fri Mar 17 2006 Greg Houlette <tamaster@pobox.com> - 1.2.8-2
+- Fixed architectural dependency during package creation eliminating
+  use of _libdir configure macro (x86_64 /usr/lib64 mis-targeting)
+
 * Tue Mar 7 2006 Greg Houlette <tamaster@pobox.com> - 1.2.8-1
 - New package version release
 - reworked the .spec file to support optional dist tag

From 34c0bedeeb1d0df7c715ffa01e9673ab773b443d Mon Sep 17 00:00:00 2001
From: tamaster <tamaster@fedoraproject.org>
Date: Sun, 19 Mar 2006 04:25:43 +0000
Subject: [PATCH 010/122] - Made an RPM transparent change to move the sha1
 canary check file out of     CVS and into the external lookaside cache (whose
 filename changes with     every new package release anyway...)

---
 .cvsignore               |  1 +
 rkhunter-1.2.8-2.src.sha | 10 ----------
 rkhunter.spec            |  7 ++++++-
 sources                  |  1 +
 4 files changed, 8 insertions(+), 11 deletions(-)
 delete mode 100644 rkhunter-1.2.8-2.src.sha

diff --git a/.cvsignore b/.cvsignore
index 8c03507..6afb7f2 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1,3 +1,4 @@
 rkhunter-1.2.8.tar.gz
 rkhunter-auto_scan.tar.gz
+rkhunter-1.2.8-3.src.sha
 clog
diff --git a/rkhunter-1.2.8-2.src.sha b/rkhunter-1.2.8-2.src.sha
deleted file mode 100644
index 5761c82..0000000
--- a/rkhunter-1.2.8-2.src.sha
+++ /dev/null
@@ -1,10 +0,0 @@
-1a882ef4351214facffcad1d5c0e7acf1a9d875b  ../SOURCES/rkhunter-1.2.8.tar.gz
-7e050d1a82a060b77943d3f7ccd82982d41f1ec3  ../SOURCES/rkhunter-auto_scan.tar.gz
-7f60ea47f064ab28ae40b7ffc8a62a68a7b14735  ../SOURCES/rkhunter-1.1.8-showfiles.patch
-4e43e6566ff748ac355aac0cde9643d8173c03be  ../SOURCES/rkhunter-1.1.9-shared_man_search.patch
-1058f002585440a9d53c7dbd4a4e4cf2778c0f21  ../SOURCES/rkhunter-1.2.7-datestamp.patch
-ad40550fab9ada953546a83ab56586ffd183a160  ../SOURCES/rkhunter-1.2.7-append_log.patch
-80148ca917ecd3117e1e2cf03237f188fa3632e7  ../SOURCES/rkhunter-1.2.7-group_log.patch
-fbf80a4343c0be375a744215bf5b834f23734525  ../SOURCES/rkhunter-1.2.7-manpage.patch
-f72d92d220edeaaaddc40155a22a2b4bc7d81b82  ../SOURCES/rkhunter-1.2.8-app_check_default.patch
-85a6bc95f36a8aa5c2f5aee0b0ab6f749d450c9d  ../SOURCES/rkhunter-1.2.8-default_settings-conf.patch
diff --git a/rkhunter.spec b/rkhunter.spec
index a4e63d6..b9627e5 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,5 +1,5 @@
 %define rkhVer 1.2.8
-%define rpmRel 2
+%define rpmRel 3
 
 # We can't let RPM do the dependencies automatic because it'll then pick up
 # a correct but undesirable perl dependency, which rkhunter does not require
@@ -190,6 +190,11 @@ fi
 
 
 %changelog
+* Sat Mar 18 2006 Greg Houlette <tamaster@pobox.com> - 1.2.8-3
+- Made an RPM transparent change to move the sha1 canary check
+  file out of CVS and into the external lookaside cache (whose
+  filename changes with every new package release anyway...)
+
 * Fri Mar 17 2006 Greg Houlette <tamaster@pobox.com> - 1.2.8-2
 - Fixed architectural dependency during package creation eliminating
   use of _libdir configure macro (x86_64 /usr/lib64 mis-targeting)
diff --git a/sources b/sources
index 595f274..8e16946 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,3 @@
 41122193b5006b617e03c637a17ae982  rkhunter-1.2.8.tar.gz
 a80c43eec631b565ca8b85e7ce9b8724  rkhunter-auto_scan.tar.gz
+31a24aa09e6afa4cc0ec783dfe429a58  rkhunter-1.2.8-3.src.sha

From 5dd0f70d448bccbacd9a0d147c681476785e47cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ville=20Skytt=C3=A4?= <scop@fedoraproject.org>
Date: Sun, 27 Aug 2006 21:05:58 +0000
Subject: [PATCH 011/122] 
 http://fedoraproject.org/wiki/Extras/Schedule/FC6MassRebuild

---
 needs.rebuild | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 needs.rebuild

diff --git a/needs.rebuild b/needs.rebuild
new file mode 100644
index 0000000..815fd29
--- /dev/null
+++ b/needs.rebuild
@@ -0,0 +1 @@
+http://fedoraproject.org/wiki/Extras/Schedule/FC6MassRebuild

From a49058e01fefc8a91dc7e6e3f4eb2f5e6806ee29 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ville=20Skytt=C3=A4?= <scop@fedoraproject.org>
Date: Wed, 11 Oct 2006 21:31:56 +0000
Subject: [PATCH 012/122] 
 http://fedoraproject.org/wiki/Extras/Schedule/FC6MassRebuild

---
 .cvsignore                                 |   4 -
 Makefile                                   |  21 --
 needs.rebuild => dead.package              |   0
 rkhunter-1.1.8-showfiles.patch             |  17 --
 rkhunter-1.1.9-shared_man_search.patch     |  11 -
 rkhunter-1.2.7-append_log.patch            |  65 -----
 rkhunter-1.2.7-datestamp.patch             |  42 ---
 rkhunter-1.2.7-group_log.patch             |  11 -
 rkhunter-1.2.7-manpage.patch               |  38 ---
 rkhunter-1.2.8-app_check_default.patch     |  31 --
 rkhunter-1.2.8-default_settings-conf.patch |  24 --
 rkhunter.spec                              | 314 ---------------------
 sources                                    |   3 -
 13 files changed, 581 deletions(-)
 delete mode 100644 .cvsignore
 delete mode 100644 Makefile
 rename needs.rebuild => dead.package (100%)
 delete mode 100644 rkhunter-1.1.8-showfiles.patch
 delete mode 100644 rkhunter-1.1.9-shared_man_search.patch
 delete mode 100644 rkhunter-1.2.7-append_log.patch
 delete mode 100644 rkhunter-1.2.7-datestamp.patch
 delete mode 100644 rkhunter-1.2.7-group_log.patch
 delete mode 100644 rkhunter-1.2.7-manpage.patch
 delete mode 100644 rkhunter-1.2.8-app_check_default.patch
 delete mode 100644 rkhunter-1.2.8-default_settings-conf.patch
 delete mode 100644 rkhunter.spec
 delete mode 100644 sources

diff --git a/.cvsignore b/.cvsignore
deleted file mode 100644
index 6afb7f2..0000000
--- a/.cvsignore
+++ /dev/null
@@ -1,4 +0,0 @@
-rkhunter-1.2.8.tar.gz
-rkhunter-auto_scan.tar.gz
-rkhunter-1.2.8-3.src.sha
-clog
diff --git a/Makefile b/Makefile
deleted file mode 100644
index 633afa8..0000000
--- a/Makefile
+++ /dev/null
@@ -1,21 +0,0 @@
-# Makefile for source rpm: rkhunter
-# $Id: Makefile,v 1.1 2004/11/08 05:17:50 cvsextras Exp $
-NAME := rkhunter
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON	:= $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)
diff --git a/needs.rebuild b/dead.package
similarity index 100%
rename from needs.rebuild
rename to dead.package
diff --git a/rkhunter-1.1.8-showfiles.patch b/rkhunter-1.1.8-showfiles.patch
deleted file mode 100644
index f32ebab..0000000
--- a/rkhunter-1.1.8-showfiles.patch
+++ /dev/null
@@ -1,17 +0,0 @@
---- files/showfiles.pl.orig	2003-12-13 09:24:35.000000000 -0500
-+++ files/showfiles.pl	2004-09-27 23:47:08.000000000 -0500
-@@ -12,11 +12,11 @@
- 
-     foreach $file (@filenames)
-       {
--	if ($file ne "." && $file ne "..")
-+	if (substr($file,0,1) eq ".")
- 	  {
--	    if(substr($file,0,1) eq ".")
-+	    if( ! ($file eq "." || $file eq ".."))
- 	      {
--	        print $viewdir,"/",$file,"\n";
-+	        print $viewdir,"/",$file," ";
- 	      }
- 	  }
-       }
diff --git a/rkhunter-1.1.9-shared_man_search.patch b/rkhunter-1.1.9-shared_man_search.patch
deleted file mode 100644
index 5a55523..0000000
--- a/rkhunter-1.1.9-shared_man_search.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- files/rkhunter.orig	2004-12-28 12:45:21.000000000 -0500
-+++ files/rkhunter	2004-12-31 13:25:53.000000000 -0500
-@@ -4127,7 +4127,7 @@
- 	
- 	displaytext -n "   Scanning for hidden files..."
- 
--	SEARCHINDIRS="/dev /bin /usr /usr/man /usr/man/man1 /usr/man/man8 /usr/bin /usr/sbin /sbin /etc"
-+	SEARCHINDIRS="/dev /bin /usr /usr/share/man /usr/share/man/man1 /usr/share/man/man8 /usr/bin /usr/sbin /sbin /etc"
- 	# Only reset status once
- 	STATUS=0
- 
diff --git a/rkhunter-1.2.7-append_log.patch b/rkhunter-1.2.7-append_log.patch
deleted file mode 100644
index 96c40f8..0000000
--- a/rkhunter-1.2.7-append_log.patch
+++ /dev/null
@@ -1,65 +0,0 @@
---- files/rkhunter.orig	2005-05-24 00:40:22.000000000 -0500
-+++ files/rkhunter	2005-06-04 11:46:17.000000000 -0500
-@@ -35,9 +35,10 @@
- CHECK=0
- 
- # Debugging
--DEBUG=1
-+DEBUG=0
- DEBUGLOG=0
- CATLOGFILE=0
-+APPENDLOG=0
- 
- VERSIONCHECK=0
- UPDATE=0
-@@ -136,6 +137,13 @@
-       --allow-ssh-root-user)
-           ALLOW_SSH_ROOT_USER="1"
- 	  ;;
-+      --append-log)
-+          shift
-+          DEBUGFILE=$1
-+          DEBUGLOG=1
-+          DEBUG=0
-+          APPENDLOG=1
-+	  ;;
-       -c | --checkall) 
- 	  CHECK=1
- 	  ;;
-@@ -235,18 +243,21 @@
-     # Through the drain...
-     DEBUGFILE="/dev/null"
-   else
--    if [ -d "/var/log" ]
-+    if [ "${DEBUGFILE}" = "" ]
-       then
--        DEBUGFILE="/var/log/rkhunter.log"
--      else
--        echo "/var/log doesn't exists... no log file created"
--	DEBUGFILE="/dev/null"
-+        if [ -d "/var/log" ]
-+          then
-+            DEBUGFILE="/var/log/rkhunter.log"
-+          else
-+            echo "/var/log doesn't exists... no log file created"
-+	    DEBUGFILE="/dev/null"
-+        fi
-     fi
-     # Clear debug file
--    if [ -f ${DEBUGFILE} ]; then
-+    if [ ${APPENDLOG} -eq 0 -a -f ${DEBUGFILE} ]; then
-       rm -f ${DEBUGFILE}
-+      touch ${DEBUGFILE}
-     fi
--
- fi
- 
- if [ "${DEBUGFILE}" = "" ]; then
-@@ -5060,6 +5071,7 @@
-     echo $ECHOOPT "--version                 : Show version and quit"
-     echo $ECHOOPT "--versioncheck            : Check for latest version"    
-     echo $ECHOOPT ""
-+    echo $ECHOOPT "--append-log <file>*      : Append (instead of overwrite) logfile output to <file>"
-     echo $ECHOOPT "--bindir <bindir>*        : Use <bindir> instead of using default binaries"
-     echo $ECHOOPT "--configfile <file>*      : Use different configuration file"    
-     echo $ECHOOPT "--dbdir <dir>*            : Use <dbdir> as database directory"        
diff --git a/rkhunter-1.2.7-datestamp.patch b/rkhunter-1.2.7-datestamp.patch
deleted file mode 100644
index 08301db..0000000
--- a/rkhunter-1.2.7-datestamp.patch
+++ /dev/null
@@ -1,42 +0,0 @@
---- files/rkhunter.orig	2005-05-24 00:40:22.000000000 -0500
-+++ files/rkhunter	2005-05-29 15:20:25.000000000 -0500
-@@ -576,7 +576,7 @@
- 
- 
- logtext "Running ${PROGRAM_NAME} ${PROGRAM_version} on ${hostname}"
--logtext "${PROGRAM_license}"
-+logtext "`date -R` ${PROGRAM_license}"
- 
- 
- ##################################################################################################
-@@ -1687,7 +1687,7 @@
-   then
-     displaytext ""; displaytext "";
-     displaytext "${PROGRAM_NAME} ${PROGRAM_version} is running"
--    displaytext ""
-+    displaytext "`date -R`"
-     displaytext -n "Determining OS... "
- 
-     if [ "${OPERATING_SYSTEM}" = "Darwin" ]
-@@ -4899,7 +4899,7 @@
- 	    fi
- 	  
- 	    displaytext ""
--	    displaytext "-----------------------------------------------------------------------"
-+	    displaytext "------------------- `date -R` -------------------"
- 	    displaytext ""
- 	    displaytext "Do you have some problems, undetected rootkits, false positives, ideas"
- 	    displaytext "or suggestions?"
-@@ -4981,10 +4981,10 @@
- 
- if [ "${UPDATE}" -eq 1 ]
-   then
--    displaytext "Running updater..."
-+    displaytext -e "\nRunning rkhunter updater... `date -R`"
-     displaytext ""
-     ${MYDIR}/lib/rkhunter/scripts/check_update.sh ${CONFIGFILE} ${MIRRORFILE} ${DB_PATH} ${md5} ${DEBUGFILE}
--    displaytext ""
-+    displaytext "Finished rkhunter updater.. `date -R`"
-     displaytext "Ready."
- fi
- 
diff --git a/rkhunter-1.2.7-group_log.patch b/rkhunter-1.2.7-group_log.patch
deleted file mode 100644
index 83cfe64..0000000
--- a/rkhunter-1.2.7-group_log.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- files/rkhunter.orig	2005-05-24 00:40:22.000000000 -0500
-+++ files/rkhunter	2005-05-31 22:41:52.000000000 -0500
-@@ -3979,7 +3979,7 @@
- 		cp /etc/group ${TMPDIR}/group
- 	      else
- 	        displaytext "${BAD}Error. ${NORMAL}Cannot find /etc/group"
--		logtext "Can't find /etc/passwd file?!?"
-+		logtext "Can't find /etc/group file?!?"
- 	    fi
-         fi
- 
diff --git a/rkhunter-1.2.7-manpage.patch b/rkhunter-1.2.7-manpage.patch
deleted file mode 100644
index 8d989f1..0000000
--- a/rkhunter-1.2.7-manpage.patch
+++ /dev/null
@@ -1,38 +0,0 @@
---- files/development/rkhunter.8.orig	2005-03-19 07:10:16.000000000 -0500
-+++ files/development/rkhunter.8	2005-06-05 11:37:23.000000000 -0500
-@@ -13,7 +13,8 @@
- 
- 
- \fBrkhunter\fP [-c|--checkall] [--createlogfile] [--cronjob] 
--[--disable-md5-check] [--nocolors] [--versioncheck]
-+[--disable-md5-check] [--help] [--nocolors] [--run-application-check]
-+[--update] [--versioncheck]
- .fam T
- .fi
- .SH DESCRIPTION
-@@ -101,6 +102,12 @@
- Changes the default root directory, for chroot environments.
- .TP
- .B
-+--run-application-check
-+Finds and checks various significant applications for downrev 
-+versions (with possible vulnerabilities) and recommends their 
-+update to more recent versions.
-+.TP
-+.B
- --tmpdir
- Changes the default directory for temporary storage
- .TP
-@@ -109,6 +116,12 @@
- Make rkhunter non-interactive
- .TP
- .B
-+--update
-+Checks the \fBrkhunter\fP mirror list to determine if any newer 
-+versions of the file signature database files are available for 
-+download.  Should be run often.
-+.TP
-+.B
- --versioncheck
- Consults the \fBrkhunter\fP website to determine if a newer 
- version is available for download. Uses wget. The latest version
diff --git a/rkhunter-1.2.8-app_check_default.patch b/rkhunter-1.2.8-app_check_default.patch
deleted file mode 100644
index 84fdeb0..0000000
--- a/rkhunter-1.2.8-app_check_default.patch
+++ /dev/null
@@ -1,31 +0,0 @@
---- files/rkhunter.orig	2006-02-14 05:35:20.000000000 -0500
-+++ files/rkhunter	2006-03-05 14:20:37.000000000 -0500
-@@ -49,7 +49,7 @@
- # Skip passwd/group check
- PASSWDCHECK_SKIP=0
- # Application check
--APPLICATION_CHECK=1
-+APPLICATION_CHECK=0
- 
- # Patched software versions?
- USE_PATCHED_SOFTWARE=0
-@@ -196,6 +196,9 @@
-           shift
- 	  ROOTDIR=$1
-           ;;
-+      --run-application-check | --runapplicationcheck | --run-applicationcheck)
-+          APPLICATION_CHECK=1
-+          ;;
-       --scan-knownbad-files)
-           PERFORMKNOWNBAD=1
-           ;;
-@@ -5053,7 +5056,8 @@
-     echo $ECHOOPT "--report-mode*            : Don't show uninteresting information for reports"
-     echo $ECHOOPT "--report-warnings-only*   : Show only warnings (lesser output than --report-mode,"
-     echo $ECHOOPT "                            more than --quiet)"
--    echo $ECHOOPT "--skip-application-check* : Don't run application version checks"
-+#    echo $ECHOOPT "--skip-application-check* : Don't run application version checks"
-+    echo $ECHOOPT "--run-application-check*  : Run application version checks"
-     echo $ECHOOPT "--skip-keypress (-sk)*    : Don't wait after every test (non-interactive)"
-     echo $ECHOOPT "--quick*                  : Perform quick scan (instead of full scan)"
-     echo $ECHOOPT "--quiet*                  : Be quiet (only show warnings)"    
diff --git a/rkhunter-1.2.8-default_settings-conf.patch b/rkhunter-1.2.8-default_settings-conf.patch
deleted file mode 100644
index fd392d7..0000000
--- a/rkhunter-1.2.8-default_settings-conf.patch
+++ /dev/null
@@ -1,24 +0,0 @@
---- files/rkhunter.conf.orig	2005-03-19 12:27:20.000000000 -0500
-+++ files/rkhunter.conf	2006-03-06 06:17:26.000000000 -0500
-@@ -3,6 +3,7 @@
- #
- # All lines beginning with a dash (#) or empty lines, will be ignored.
- #
-+#INSTALLDIR=/usr/local
- 
- # Links to files. Don't change if you don't need to.
- LATESTVERSION=/rkhunter_latest.dat
-@@ -37,11 +38,12 @@
- # Allow hidden directory
- # One directory per line (use multiple ALLOWHIDDENDIR lines)
- #
-+#ALLOWHIDDENDIR=/dev/.udevdb
- #ALLOWHIDDENDIR=/etc/.java
- 
- # Allow hidden file
- # One file per line (use multiple ALLOWHIDDENFILE lines)
- # 
--#ALLOWHIDDENFILE=/etc/.java
-+#ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
- 
- # The End
diff --git a/rkhunter.spec b/rkhunter.spec
deleted file mode 100644
index b9627e5..0000000
--- a/rkhunter.spec
+++ /dev/null
@@ -1,314 +0,0 @@
-%define rkhVer 1.2.8
-%define rpmRel 3
-
-# We can't let RPM do the dependencies automatic because it'll then pick up
-# a correct but undesirable perl dependency, which rkhunter does not require
-# in order to function properly [perl(Digest::MD5) & perl(Digest::SHA1)].
-AutoReqProv:    no
-
-Name:           rkhunter
-Version:        %{rkhVer}
-Release:        %{rpmRel}%{?dist}
-Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
-
-Group:          Applications/System
-License:        GPL
-URL:            http://www.rootkit.nl/
-Source0:        http://downloads.rootkit.nl/rkhunter-1.2.8.tar.gz
-Source1:        rkhunter-auto_scan.tar.gz
-Source2:        rkhunter-%{rkhVer}-%{rpmRel}.src.sha
-Patch0:         rkhunter-1.2.8-default_settings-conf.patch
-Patch1:         rkhunter-1.1.8-showfiles.patch
-Patch2:         rkhunter-1.1.9-shared_man_search.patch
-Patch3:         rkhunter-1.2.8-app_check_default.patch
-Patch4:         rkhunter-1.2.7-datestamp.patch
-Patch5:         rkhunter-1.2.7-append_log.patch
-Patch6:         rkhunter-1.2.7-group_log.patch
-Patch7:         rkhunter-1.2.7-manpage.patch
-BuildArch:      noarch
-BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-
-Requires:       /bin/sh, coreutils, binutils, modutils, findutils, grep, mktemp
-Requires:       e2fsprogs, procps, lsof, prelink, iproute, net-tools, wget
-Requires:       perl, perl(strict), perl(IO::Socket), mailx
-
-%description
-Rootkit Hunter scans files and systems for known and unknown rootkits,
-backdoors, and sniffers.  The package contains one shell script, a few
-text-based databases, and optional Perl modules.  It should run on almost
-every Unix clone.  This tool scans for rootkits, backdoors and local
-exploits by running tests like:
-        - MD5 hash compare
-        - Look for default files used by rootkits
-        - Wrong file permissions for binaries
-        - Look for suspected strings in LKM and KLD modules
-        - Look for hidden files
-        - Optional scan within plaintext and binary files
-        - Software version checks
-        - Application tests
-
-Rootkit Hunter is released as a GPL licensed project and
-is free for everyone to use.
-
-
-%prep
-
-# This optional check is for verification of original sources
-# DURING the binary build process (sha1 canary check)
-#[ ! -e %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha.orig ] \
-#    && %{__perl} -pi.orig -e '
-#	s|../SOURCES|%{_sourcedir}|g;
-#     ' %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha
-#sha1sum --check %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha || exit $?
-#%{__rm} -f %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha
-#%{__mv} %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha.orig \
-#        %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha
-
-%setup -q -n %{name}
-%setup -q -D -T -a 1 -n %{name}
-
-%patch0 -b .orig
-
-%{__perl} -pi.0001 -e '
-	s|^#(INSTALLDIR=).+$|$1%{_prefix}|;
-	s|^#(MAIL-ON-WARNING=).+$|$1root\@localhost|;
-	s|^#(TMPDIR=).+$|$1%{_var}/%{name}/tmp|;
-	s|^#(DBDIR=).+$|$1%{_var}/%{name}/db|;
-    ' files/%{name}.conf
-
-%{__perl} -pi.orig -e '
-	s|\@TMPDIR\@|%{_var}/%{name}/tmp|g;
-	s|\@STDIR\@|%{_localstatedir}|g;
-	s|\@CFGDIR\@|%{_sysconfdir}|g;
-	s|\@SCDIR\@|%{_sysconfdir}/sysconfig|g;
-	s|\@ITDIR\@|%{_initrddir}|g;
-	s|\@RKEXE\@|%{_bindir}/%{name}|g;
-	s|\@RKHSH\@|%{_bindir}/%{name}-scan.sh|g;
-	s|\@LGDIR\@|%{_localstatedir}/log|g;
-    ' 01-%{name}
-
-%patch1 -b .orig
-%patch2 -b .orig
-%patch3 -b .0001
-%patch4 -b .0002
-%patch5 -b .0003
-%patch6 -b .0004
-%patch7 -b .orig
-
-%{__cat} <<'EOF' >%{name}.logrotate
-%{_localstatedir}/log/%{name}.log {
-    weekly
-    notifempty
-    create 640 root root
-}
-EOF
-
-
-%build
-#%%configure
-# We have nothing to configure... yet...
-
-
-%install
-%{__rm} -rf $RPM_BUILD_ROOT
-
-%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_bindir}
-%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_sysconfdir}/{cron.daily,sysconfig,logrotate.d}
-%{__mkdir} -m750 -p ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts
-%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}
-%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8
-%{__mkdir} -m750 -p ${RPM_BUILD_ROOT}%{_var}/%{name}/{db,tmp}
-
-%{__install} -m750 -p files/%{name}             ${RPM_BUILD_ROOT}%{_bindir}/
-
-%{__install} -m640 -p files/backdoorports.dat   ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
-%{__install} -m640 -p files/defaulthashes.dat   ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
-%{__install} -m640 -p files/md5blacklist.dat    ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
-%{__install} -m640 -p files/mirrors.dat         ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
-%{__install} -m640 -p files/os.dat              ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
-%{__install} -m640 -p files/programs_bad.dat    ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
-%{__install} -m640 -p files/programs_good.dat   ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
-
-%{__install} -m644 -p files/CHANGELOG           ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
-%{__install} -m644 -p files/LICENSE             ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
-%{__install} -m644 -p files/README              ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
-%{__install} -m644 -p files/WISHLIST            ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
-
-%{__install} -m644 -p files/development/*.8     ${RPM_BUILD_ROOT}%{_mandir}/man8/
-
-%{__install} -m750 -p files/check_modules.pl    ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
-%{__install} -m750 -p files/check_port.pl       ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
-%{__install} -m750 -p files/check_update.sh     ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
-%{__install} -m750 -p files/filehashmd5.pl      ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
-%{__install} -m750 -p files/filehashsha1.pl     ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
-%{__install} -m750 -p files/showfiles.pl        ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
-%{__install} -m750 -p 01-%{name}                ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/
-%{__install} -m644 -p %{name}.logrotate         ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/%{name}
-%{__install} -m640 -p files/%{name}.conf        ${RPM_BUILD_ROOT}%{_sysconfdir}/
-%{__install} -m640 -p %{name}.sysconfig         ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name}
-
-
-%clean
-%{__rm} -rf $RPM_BUILD_ROOT
-# Autoclean for rpmbuild -bb
-#cd ..
-#[ ! -d %{name} ] || %{__rm} -rf %{name}
-
-
-%post
-/bin/touch %{_localstatedir}/log/%{name}.log
-/bin/echo -e "------------------- `/bin/date -R` -------------------\n" \
-  >> %{_localstatedir}/log/%{name}.log
-%{_bindir}/%{name} --version >> %{_localstatedir}/log/%{name}.log
-/bin/echo -e "\n------------------------------ Installed ------------------------------\n" \
-  >> %{_localstatedir}/log/%{name}.log
-/bin/chown root.root %{_localstatedir}/log/%{name}.log
-/bin/chmod 640 %{_localstatedir}/log/%{name}.log
-
-%postun
-if [ "$1" = 0 ]; then
-    [ ! -d %{_var}/%{name} ] || %{__rm} -rf %{_var}/%{name}
-    [ ! -d %{_prefix}/lib/%{name} ] || %{__rm} -rf %{_prefix}/lib/%{name}
-fi
-
-
-%files
-%defattr(-,root,root,-)
-%{_bindir}/%{name}
-%dir %{_prefix}/lib/%{name}
-%{_prefix}/lib/%{name}/scripts
-%{_sysconfdir}/cron.daily/01-%{name}
-%{_sysconfdir}/logrotate.d/%{name}
-%dir %{_var}/%{name}
-%{_var}/%{name}/db
-%dir %{_var}/%{name}/tmp
-%{_sysconfdir}/%{name}.conf
-%{_sysconfdir}/sysconfig/%{name}
-%dir %{_docdir}/%{name}-%{version}
-%doc %{_docdir}/%{name}-%{version}/*
-%{_mandir}/man8/*
-
-
-%changelog
-* Sat Mar 18 2006 Greg Houlette <tamaster@pobox.com> - 1.2.8-3
-- Made an RPM transparent change to move the sha1 canary check
-  file out of CVS and into the external lookaside cache (whose
-  filename changes with every new package release anyway...)
-
-* Fri Mar 17 2006 Greg Houlette <tamaster@pobox.com> - 1.2.8-2
-- Fixed architectural dependency during package creation eliminating
-  use of _libdir configure macro (x86_64 /usr/lib64 mis-targeting)
-
-* Tue Mar 7 2006 Greg Houlette <tamaster@pobox.com> - 1.2.8-1
-- New package version release
-- reworked the .spec file to support optional dist tag
-- Updated the application check default patchfile (chunk failure)
-- Changed to SHA1 for optional message digest (canary check)
-- Added a couple of suggested skip entries to rkhunter.conf
-
-* Mon Jun 11 2005 Greg Houlette <tamaster@pobox.com> - 1.2.7-1
-- Added signature auto-updating to CRON scan (new script)
-- Removed BOOTSCAN pending rewrite to full SysV Init scan in background
-- Added the --append-log command line option
-- Added Date Stamping to output
-- Fixed bug in /etc/group missing report
-- New package version release
-
-* Sun Jan 2 2005 Greg Houlette <tamaster@tekarmory.com> - 0:1.1.9-1
-- New package version release
-- Added the --run-application-check command line option
-  to listing in command help
-- Replaced 'Here' Doc editing of rkhunter.conf file
-  with in-place Perl edit
-- tweaked rpmbuild -bb Autoclean
-
-* Fri Oct 15 2004 Greg Houlette - 0:1.1.8-0.fdr.1 (revisited)
-- Removed redundant buildrequires /bin/sh, coreutils and perl
-- Revise postun scriptlet
-- Added /usr/share/doc/rkhunter-1.1.8/ to files list
-
-* Mon Oct 11 2004 Greg Houlette - 0:1.1.8-0.fdr.1
-- Changed Release Tag to 0.fdr.1 (testing) for QA
-- Removed wget from dependencies
-- Hid (temporarily) the --skip-application-check command
-  line option from being listed in help
-- Fixed the spec files list, again!
-
-* Fri Oct 8 2004 Greg Houlette - 0:1.1.8-0.fdr.0.2.beta2
-- Unified and disabled the md5 canary check in prep
-  (check is now optional) removing the sha1 cross-check
-- Fixed the spec files list, adding the /var/rkhunter
-  directory and the /usr/bin/rkhunter executable
-- Fixed missing dependencies (rkh uses runtime checks)
-- Disabled "auto-clean" for rpmbuild -bb
-- Changed Application version scan default to
-  disabled awaiting backport fix in upstream sources
-- Fixed shared_man_search.patch, configuration files
-  verify and added postun(install) cleanup
-
-* Fri Oct 1 2004 Greg Houlette - 0:1.1.8-0.fdr.0.1.beta1
-- More cosmetic patchwork
-- Changed Release Tag to beta1 (pre-release) for QA submit
-
-* Tue Sep 28 2004 Greg Houlette - 0:1.1.8-0.fdr.1
-- Removed hidden_search.patch (1.1.7) after it was
-  merged into upstream source by Michael Boelen
-- Removed .spec file from md5 and sha1 file checks
-  (it must be modifiable by Fedora QA release build)
-- Added BOOTSCAN description file to documentation
-- Restructured dynamic file creation ('Here' Docs)
-  moving them to the "prep" stage so that *_ALL_*
-  files are available prior to the "build" stage
-  (for inspection purposes)
-- Added a /etc/sysconfig/rkhunter parameters file
-
-* Sun Aug 29 2004 Greg Houlette - 0:1.1.7-0.fdr.1
-- Cosmetic patchwork
-
-* Sat Aug 21 2004 Greg Houlette - 0:1.1.6-0.fdr.1
-- Moderate reworking of .spec file for packaging standards
-- Added md5 and sha1 file checks to prep procedure for source .rpm
-- Included an optional rc.local replacement for scan on boot (with full logging)
-
-* Tue Aug 10 2004 Michael Boelen - 1.1.5
-- Added update script
-- Extended description
-
-* Sun Aug 08 2004 Greg Houlette - 1.1.5
-- Changed the install procedure eliminating the specification of
-  destination filenames (only needed if you are renaming during install)
-- Changed the permissions for documentation files (root only overkill)
-- Added the installation of the rkhunter Man Page
-- Added the installation of the programs_{bad, good}.dat database files
-- Added the installation of the LICENSE documentation file
-- Added the chmod for root only to the /var/rkhunter/db directory
-
-* Sun May 23 2004 Craig Orsinger (cjo) <cjorsinger@earthlink.net>
-- version 1.1.0-1.cjo
-- changed installation in accordance with new rootkit installation
-  procedure
-- changed installation root to conform to LSB. Use standard macros.
-- added recursive remove of old build root as prep for install phase
-
-* Wed Apr 28 2004 Doncho N. Gunchev - 1.0.9-0.mr700
-- dropped Requires: perl - rkhunter works without it 
-- dropped the bash alignpatch (check the source or contact me)
-- various file mode fixes (.../tmp/, *.db)
-- optimized the %%files section - any new files in the
-  current dirs will be fine - just %%{__install} them.
-
-* Mon Apr 26 2004 Michael Boelen - 1.0.8-0
-- Fixed missing md5blacklist.dat
-
-* Mon Apr 19 2004 Doncho N. Gunchev - 1.0.6-1.mr700
-- added missing /usr/local/rkhunter/db/md5blacklist.dat
-- patched to align results in --cronjob, I think rpm based
-  distros have symlink /bin/sh -> /bin/bash
-- added --with/--without alignpatch for conditional builds
-  (in case previous patch breaks something)
-
-* Sat Apr 03 2004 Michael Boelen / Joe Klemmer - 1.0.6-0
-- Update to 1.0.6
-
-* Mon Mar 29 2004 Doncho N. Gunchev - 1.0.0-0
-- initial .spec file
diff --git a/sources b/sources
deleted file mode 100644
index 8e16946..0000000
--- a/sources
+++ /dev/null
@@ -1,3 +0,0 @@
-41122193b5006b617e03c637a17ae982  rkhunter-1.2.8.tar.gz
-a80c43eec631b565ca8b85e7ce9b8724  rkhunter-auto_scan.tar.gz
-31a24aa09e6afa4cc0ec783dfe429a58  rkhunter-1.2.8-3.src.sha

From 7b60c279f56450c72ef2e343a889494d1fde347c Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Fri, 15 Feb 2008 04:30:23 +0000
Subject: [PATCH 013/122] Initial import of new rkhunter package

---
 01-rkhunter         |  63 +++++++++++
 Makefile            |  21 ++++
 dead.package        |   1 -
 rkhunter-1.3.0.sha1 |  46 ++++++++
 rkhunter.spec       | 262 ++++++++++++++++++++++++++++++++++++++++++++
 rkhunter.sysconfig  |  10 ++
 sources             |   1 +
 7 files changed, 403 insertions(+), 1 deletion(-)
 create mode 100755 01-rkhunter
 create mode 100644 Makefile
 delete mode 100644 dead.package
 create mode 100644 rkhunter-1.3.0.sha1
 create mode 100644 rkhunter.spec
 create mode 100644 rkhunter.sysconfig
 create mode 100644 sources

diff --git a/01-rkhunter b/01-rkhunter
new file mode 100755
index 0000000..bde5b18
--- /dev/null
+++ b/01-rkhunter
@@ -0,0 +1,63 @@
+#!/bin/sh
+# 01-rkhunter  A shell script to update and run rkhunter via CRON
+
+XITVAL=0
+
+# Get a secure tempfile
+TMPFILE1=`/bin/mktemp -p @TMPDIR@ rkhcronlog.XXXXXXXXXX` || exit 1
+
+if [ ! -e @STDIR@/lock/subsys/rkhunter ]; then
+
+  # Try to keep the SysInit boot scan from colliding with us (highly unlikely)
+  /bin/touch @STDIR@/lock/subsys/rkhunter
+
+  # Source system configuration parameters.
+  if [ -e @SCDIR@/rkhunter ] ; then
+    . @SCDIR@/rkhunter
+  else
+    MAILTO=root@localhost
+  fi
+
+  # If a diagnostic mode scan was requested, setup the parameters
+  if [ "$DIAG_SCAN" == "yes" ]; then
+    RKHUNTER_FLAGS="
+    --checkall
+    --run-application-check
+    --skip-keypress
+    --nocolors
+    --quiet
+    --append-log $TMPFILE1
+  "
+  else
+    RKHUNTER_FLAGS="
+    --cronjob
+  "
+  fi
+
+  # Set a few critical parameters
+  RKHUNTER=@RKEXE@
+  LOGFILE=@LGDIR@/rkhunter.log
+
+  # Run RootKit Hunter if available
+  if [ -x $RKHUNTER ]; then
+    /bin/echo -e "\n--------------------- Start Rootkit Hunter Update ---------------------" \
+      > $TMPFILE1
+    /bin/nice -n 10 $RKHUNTER --update 2>&1 >> $TMPFILE1
+    /bin/echo -e "\n---------------------- Start Rootkit Hunter Scan ----------------------" \
+      >> $TMPFILE1
+    /bin/nice -n 10 $RKHUNTER $RKHUNTER_FLAGS 2>&1 >> $TMPFILE1
+    XITVAL=$?
+    /bin/echo -e "\n----------------------- End Rootkit Hunter Scan -----------------------" \
+      >> $TMPFILE1
+    /bin/cat $TMPFILE1 | /bin/mail -s 'rkhunter Daily Run' $MAILTO
+    /bin/cat $TMPFILE1 >> $LOGFILE
+  fi
+
+  # Delete the gating lockfile
+  /bin/rm -f @STDIR@/lock/subsys/rkhunter
+fi
+
+# Delete the secure tempfile
+/bin/rm -f $TMPFILE1
+
+exit $XITVAL
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..6a822c7
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,21 @@
+# Makefile for source rpm: rkhunter
+# $Id$
+NAME := rkhunter
+SPECFILE = $(firstword $(wildcard *.spec))
+
+define find-makefile-common
+for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
+endef
+
+MAKEFILE_COMMON := $(shell $(find-makefile-common))
+
+ifeq ($(MAKEFILE_COMMON),)
+# attept a checkout
+define checkout-makefile-common
+test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
+endef
+
+MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
+endif
+
+include $(MAKEFILE_COMMON)
diff --git a/dead.package b/dead.package
deleted file mode 100644
index 815fd29..0000000
--- a/dead.package
+++ /dev/null
@@ -1 +0,0 @@
-http://fedoraproject.org/wiki/Extras/Schedule/FC6MassRebuild
diff --git a/rkhunter-1.3.0.sha1 b/rkhunter-1.3.0.sha1
new file mode 100644
index 0000000..720767b
--- /dev/null
+++ b/rkhunter-1.3.0.sha1
@@ -0,0 +1,46 @@
+225cc53f9691ad39f10bd2aaac478355ce4dc411  rkhunter-1.3.0/files/contrib/README.txt
+285155f63cfa7a6a73ec0352dccaaa2221989b94  rkhunter-1.3.0/files/contrib/rkhunter_remote_howto.txt
+beed9c4b594c5be28ca4837fdcd2ac367e2946ee  rkhunter-1.3.0/files/contrib/run_rkhunter.sh
+e715f42bc634c5497eb83014acd8cbcbea5e4611  rkhunter-1.3.0/files/ACKNOWLEDGMENTS
+b633fb9d5dd05f68749dbf1cc268e0822f6ee4ca  rkhunter-1.3.0/files/CHANGELOG
+e7f8437125c35b69c79e1d93baa9eb205cc7f2ac  rkhunter-1.3.0/files/FAQ
+345ab306455525cf5626caadda22b5dcbf732bc1  rkhunter-1.3.0/files/LICENSE
+fc8f29a947e4345ab15d5d56280761865d61a239  rkhunter-1.3.0/files/README
+73a42c94be2fb1fd3284d8dc60d22ff0fc8407f4  rkhunter-1.3.0/files/WISHLIST
+9ddeec64999f4c0e6f9aa5992cd25c503311b764  rkhunter-1.3.0/files/backdoorports.dat
+a0badd192cc4f33fbf38f446eae3c858ba81c88f  rkhunter-1.3.0/files/check_modules.pl
+5c4319fe3f9acc552b7a9e973b7d081f7cb31642  rkhunter-1.3.0/files/check_port.pl
+996a29dee608374e601ecf0253e445e16506c672  rkhunter-1.3.0/files/check_update.sh
+59de768a09a4cd13599653df85ecc2362e416ab3  rkhunter-1.3.0/files/defaulthashes.dat
+ebc05604eb51b10478d35ac3750699cefecd5ae3  rkhunter-1.3.0/files/filehashmd5.pl
+1878119b6045eeab6a5afaebad7b523e86c3a935  rkhunter-1.3.0/files/filehashsha1.pl
+82c8c3881d59d228de3ce74a4b7b68eac07940f1  rkhunter-1.3.0/files/md5blacklist.dat
+a656a91b37a83a2325843f0ccedb5eb7866506ac  rkhunter-1.3.0/files/mirrors.dat
+951b498f71fc4a126ca435f7bce96ed8b821efb6  rkhunter-1.3.0/files/os.dat
+c82074175e72642dd74322ce29281f0f2fe2798c  rkhunter-1.3.0/files/programs_bad.dat
+d5bff919ce44a345a193824ea16b0404008d7823  rkhunter-1.3.0/files/programs_good.dat
+d824c9ca8b591d108bd7b194350166ac65e64212  rkhunter-1.3.0/files/readlink.sh
+41fa7cdcd45fc96d730c1e54a0eb40d4d4c2c428  rkhunter-1.3.0/files/rkhunter
+7098a383b12612e1cf7191963e039936fc788ba0  rkhunter-1.3.0/files/rkhunter.8
+ad8112c0678b56d652857ec933bf6b60145045f7  rkhunter-1.3.0/files/rkhunter.conf
+eb5d6ef0c5cd9dec13a98c66ab82e1ccae62121f  rkhunter-1.3.0/files/rkhunter.spec
+43bca835d9c64ab2f8cf7f1a5a078bb1b7da9306  rkhunter-1.3.0/files/showfiles.pl
+5dfa5246dc1c87b05f44f9f444466ce3d0d6edec  rkhunter-1.3.0/files/stat.pl
+ec4d60774decbb354f7aafcc2b65b1f87e000c97  rkhunter-1.3.0/files/suspscan.dat
+e158163bfe6cb414d839e91880af37611f8b5cc0  rkhunter-1.3.0/files/development/createfilehashes.pl
+cb4903c649ad50b79230f5a5250da82c1d9ccb0f  rkhunter-1.3.0/files/development/createhashes.sh
+6b2f032d6143ed3b6ba3eae19d7921e154e69e47  rkhunter-1.3.0/files/development/createhashesall.sh
+d09ab61a3563122b8cd6415e3083dfe1ef285a2b  rkhunter-1.3.0/files/development/i18nchk
+0c613880f3447af695ca9f9f93e158b34c2a10c3  rkhunter-1.3.0/files/development/osinformation.sh
+614a5d3999055a8faeecc393c5695d628e5a7675  rkhunter-1.3.0/files/development/rpmhashes.sh
+4f4dfb87e758236cadc5ac5af67bbb35f4f63eb1  rkhunter-1.3.0/files/development/rpmprelinkhashes.sh
+7378fb7e91b1f7e789508e4e8d00e1e3a70ee6ff  rkhunter-1.3.0/files/development/search_dead_sysmlinks.sh
+52ac2bcbe9524971cc535b20fb6d3442f53ea8b0  rkhunter-1.3.0/files/i18n/cn
+a36507f61ba0932774bfaed58708edb8ded567dd  rkhunter-1.3.0/files/i18n/en
+73e76916a3f65dde2317fff6c932e1d77760fdf7  rkhunter-1.3.0/files/testing/rkhunter.conf
+361ada5406c7e57e62e840caf3d3bce5e8436fc1  rkhunter-1.3.0/files/testing/rootkitinfo.txt
+56bf42d4fe669412b84eb307d5e314af4501dc9a  rkhunter-1.3.0/files/testing/stringscanner.sh
+ff10891d252f3859abe63054eb64f0e9eae2d781  rkhunter-1.3.0/files/tools/README
+90876286c511986474144a5a1fc21afa0f5f29c5  rkhunter-1.3.0/files/tools/update_client.sh
+e3ba269e33d5d385230d0a4457d87cf6e3acece8  rkhunter-1.3.0/files/tools/update_server.sh
+737e3663adbd1f36eab4b668a16462da3278c04d  rkhunter-1.3.0/installer.sh
diff --git a/rkhunter.spec b/rkhunter.spec
new file mode 100644
index 0000000..2b06545
--- /dev/null
+++ b/rkhunter.spec
@@ -0,0 +1,262 @@
+Name:           rkhunter
+Version:        1.3.0
+Release:        1%{?dist}
+Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
+
+Group:          Applications/System
+License:        GPLv2+
+URL:            http://rkhunter.sourceforge.net/
+Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.0.tar.gz
+Source1:        http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.0.sha1
+Source2:        01-rkhunter
+Source3:        rkhunter.sysconfig
+BuildArch:      noarch
+BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+
+Requires:       coreutils, binutils, modutils, findutils, grep, mktemp
+Requires:       e2fsprogs, procps, lsof, prelink, iproute, net-tools, wget
+Requires:       perl, perl(strict), perl(IO::Socket), mailx, logrotate
+
+%description
+Rootkit Hunter (RKH) is an easy-to-use tool which checks
+computers running UNIX (clones) for the presence of rootkits
+and other unwanted tools.
+
+%prep
+
+%setup -q
+
+%{__perl} -pi.0001 -e '
+	s|^#(MAIL-ON-WARNING=).+$|$1root\@localhost|;
+	s|^#(TMPDIR=).+$|$1%{_var}/%{name}/tmp|;
+	s|^#(DBDIR=).+$|$1%{_var}/%{name}/db|;
+	s|^#(SCRIPTDIR=).+$|$1%{_datadir}/%{name}/scripts|;
+	s|^#(PKGMGR=).+$|$1RPM|;
+	s|^#(OS_VERSION_FILE=).+$|$1/etc/fedora-release|;
+	s|^#(ALLOWHIDDENDIR=).+$|$1/dev/.udev|;
+	s|^#(ALLOWHIDDENDIR=).+$|$1/usr/share/man/man1/..1.gz|;
+	s|^(APPEND_LOG=).+$|$11|;
+	s|^(ALLOW_SSH_ROOT_USER=).+$|$1yes|;
+	s|^(DISABLE_TESTS=).+$|$1"additional_rkts suspscan hidden_procs deleted_files packet_cap_apps"|;
+    ' files/%{name}.conf
+
+# Add Fedora specific configs
+echo "INSTALLDIR=%{_prefix}" >> files/%{name}.conf
+echo "SCRIPTWHITELIST=/usr/bin/whatis" >> files/%name.conf
+echo "SCRIPTWHITELIST=/usr/bin/ldd" >> files/%name.conf
+echo "SCRIPTWHITELIST=/usr/bin/groups" >> files/%name.conf
+echo "SCRIPTWHITELIST=/usr/bin/GET" >> files/%name.conf
+echo "SCRIPTWHITELIST=/sbin/ifup" >> files/%name.conf
+echo "SCRIPTWHITELIST=/sbin/ifdown" >> files/%name.conf
+# in f8/f9
+echo "SYSLOG_CONFIG_FILE=/etc/rsyslog.conf" >> files/%name.conf
+
+%{__perl} -pi.orig -e '
+	s|\@TMPDIR\@|%{_var}/%{name}/tmp|g;
+	s|\@STDIR\@|%{_localstatedir}|g;
+	s|\@CFGDIR\@|%{_sysconfdir}|g;
+	s|\@SCDIR\@|%{_sysconfdir}/sysconfig|g;
+	s|\@ITDIR\@|%{_initrddir}|g;
+	s|\@RKEXE\@|%{_bindir}/%{name}|g;
+	s|\@RKHSH\@|%{_bindir}/%{name}-scan.sh|g;
+	s|\@LGDIR\@|%{_localstatedir}/log|g;
+    ' 01-%{name}
+
+%{__cat} <<'EOF' >%{name}.logrotate
+%{_localstatedir}/log/%{name}.log {
+    weekly
+    notifempty
+    create 640 root root
+}
+EOF
+
+%build
+# Nothing to be built
+
+%install
+%{__rm} -rf $RPM_BUILD_ROOT
+
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_bindir}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_sysconfdir}/{cron.daily,sysconfig,logrotate.d}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/%{name}/{db,tmp}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/%{name}/db/i18n
+
+%{__install} -m755 -p files/%{name}             ${RPM_BUILD_ROOT}%{_bindir}/
+
+%{__install} -m644 -p files/backdoorports.dat   ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
+%{__install} -m644 -p files/defaulthashes.dat   ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
+%{__install} -m644 -p files/md5blacklist.dat    ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
+%{__install} -m644 -p files/mirrors.dat         ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
+%{__install} -m644 -p files/os.dat              ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
+%{__install} -m644 -p files/programs_bad.dat    ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
+%{__install} -m644 -p files/programs_good.dat   ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
+%{__install} -m644 -p files/i18n/cn             ${RPM_BUILD_ROOT}%{_var}/%{name}/db/i18n/
+%{__install} -m644 -p files/i18n/en             ${RPM_BUILD_ROOT}%{_var}/%{name}/db/i18n/
+
+%{__install} -m644 -p files/CHANGELOG           ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
+%{__install} -m644 -p files/LICENSE             ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
+%{__install} -m644 -p files/README              ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
+%{__install} -m644 -p files/WISHLIST            ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
+%{__install} -m755 -p files/check_modules.pl    ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/
+%{__install} -m755 -p files/check_port.pl       ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/
+%{__install} -m755 -p files/check_update.sh     ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/
+%{__install} -m644 -p files/*.8                 ${RPM_BUILD_ROOT}%{_mandir}/man8/
+# Don't ship these unless we want to Require the perl modules
+#%{__install} -m750 -p files/filehashmd5.pl      ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
+#%{__install} -m750 -p files/filehashsha1.pl     ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
+%{__install} -m755 -p files/showfiles.pl        ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/
+%{__install} -m755 -p %{SOURCE2}                ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/
+%{__install} -m644 -p %{name}.logrotate         ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/%{name}
+%{__install} -m640 -p files/%{name}.conf        ${RPM_BUILD_ROOT}%{_sysconfdir}/
+%{__install} -m640 -p %{SOURCE3}                ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name}
+
+%clean
+%{__rm} -rf $RPM_BUILD_ROOT
+
+%files
+%defattr(-,root,root,-)
+%doc %{_docdir}/%{name}-%{version}/*
+%{_bindir}/%{name}
+%dir %{_datadir}/%{name}
+%{_datadir}/%{name}/scripts
+%{_sysconfdir}/cron.daily/01-%{name}
+%config(noreplace) %{_sysconfdir}/logrotate.d/%{name}
+%dir %{_var}/%{name}
+%{_var}/%{name}/db
+%{_var}/%{name}/db/i18n
+%dir %{_var}/%{name}/tmp
+%config(noreplace) %{_sysconfdir}/%{name}.conf
+%config(noreplace) %{_sysconfdir}/sysconfig/%{name}
+%dir %{_docdir}/%{name}-%{version}
+%{_mandir}/man8/*
+
+%changelog
+* Sun Feb 03 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.0-1
+- Revive package, clean up spec
+- Update to 1.3.0
+
+* Sat Mar 18 2006 Greg Houlette <tamaster@pobox.com> - 1.2.8-3
+- Made an RPM transparent change to move the sha1 canary check
+  file out of CVS and into the external lookaside cache (whose
+  filename changes with every new package release anyway...)
+
+* Fri Mar 17 2006 Greg Houlette <tamaster@pobox.com> - 1.2.8-2
+- Fixed architectural dependency during package creation eliminating
+  use of _libdir configure macro (x86_64 /usr/lib64 mis-targeting)
+
+* Tue Mar 7 2006 Greg Houlette <tamaster@pobox.com> - 1.2.8-1
+- New package version release
+- reworked the .spec file to support optional dist tag
+- Updated the application check default patchfile (chunk failure)
+- Changed to SHA1 for optional message digest (canary check)
+- Added a couple of suggested skip entries to rkhunter.conf
+
+* Mon Jun 11 2005 Greg Houlette <tamaster@pobox.com> - 1.2.7-1
+- Added signature auto-updating to CRON scan (new script)
+- Removed BOOTSCAN pending rewrite to full SysV Init scan in background
+- Added the --append-log command line option
+- Added Date Stamping to output
+- Fixed bug in /etc/group missing report
+- New package version release
+
+* Sun Jan 2 2005 Greg Houlette <tamaster@tekarmory.com> - 0:1.1.9-1
+- New package version release
+- Added the --run-application-check command line option
+  to listing in command help
+- Replaced 'Here' Doc editing of rkhunter.conf file
+  with in-place Perl edit
+- tweaked rpmbuild -bb Autoclean
+
+* Fri Oct 15 2004 Greg Houlette - 0:1.1.8-0.fdr.1 (revisited)
+- Removed redundant buildrequires /bin/sh, coreutils and perl
+- Revise postun scriptlet
+- Added /usr/share/doc/rkhunter-1.1.8/ to files list
+
+* Mon Oct 11 2004 Greg Houlette - 0:1.1.8-0.fdr.1
+- Changed Release Tag to 0.fdr.1 (testing) for QA
+- Removed wget from dependencies
+- Hid (temporarily) the --skip-application-check command
+  line option from being listed in help
+- Fixed the spec files list, again!
+
+* Fri Oct 8 2004 Greg Houlette - 0:1.1.8-0.fdr.0.2.beta2
+- Unified and disabled the md5 canary check in prep
+  (check is now optional) removing the sha1 cross-check
+- Fixed the spec files list, adding the /var/rkhunter
+  directory and the /usr/bin/rkhunter executable
+- Fixed missing dependencies (rkh uses runtime checks)
+- Disabled "auto-clean" for rpmbuild -bb
+- Changed Application version scan default to
+  disabled awaiting backport fix in upstream sources
+- Fixed shared_man_search.patch, configuration files
+  verify and added postun(install) cleanup
+
+* Fri Oct 1 2004 Greg Houlette - 0:1.1.8-0.fdr.0.1.beta1
+- More cosmetic patchwork
+- Changed Release Tag to beta1 (pre-release) for QA submit
+
+* Tue Sep 28 2004 Greg Houlette - 0:1.1.8-0.fdr.1
+- Removed hidden_search.patch (1.1.7) after it was
+  merged into upstream source by Michael Boelen
+- Removed .spec file from md5 and sha1 file checks
+  (it must be modifiable by Fedora QA release build)
+- Added BOOTSCAN description file to documentation
+- Restructured dynamic file creation ('Here' Docs)
+  moving them to the "prep" stage so that *_ALL_*
+  files are available prior to the "build" stage
+  (for inspection purposes)
+- Added a /etc/sysconfig/rkhunter parameters file
+
+* Sun Aug 29 2004 Greg Houlette - 0:1.1.7-0.fdr.1
+- Cosmetic patchwork
+
+* Sat Aug 21 2004 Greg Houlette - 0:1.1.6-0.fdr.1
+- Moderate reworking of .spec file for packaging standards
+- Added md5 and sha1 file checks to prep procedure for source .rpm
+- Included an optional rc.local replacement for scan on boot (with full logging)
+
+* Tue Aug 10 2004 Michael Boelen - 1.1.5
+- Added update script
+- Extended description
+
+* Sun Aug 08 2004 Greg Houlette - 1.1.5
+- Changed the install procedure eliminating the specification of
+  destination filenames (only needed if you are renaming during install)
+- Changed the permissions for documentation files (root only overkill)
+- Added the installation of the rkhunter Man Page
+- Added the installation of the programs_{bad, good}.dat database files
+- Added the installation of the LICENSE documentation file
+- Added the chmod for root only to the /var/rkhunter/db directory
+
+* Sun May 23 2004 Craig Orsinger (cjo) <cjorsinger@earthlink.net>
+- version 1.1.0-1.cjo
+- changed installation in accordance with new rootkit installation
+  procedure
+- changed installation root to conform to LSB. Use standard macros.
+- added recursive remove of old build root as prep for install phase
+
+* Wed Apr 28 2004 Doncho N. Gunchev - 1.0.9-0.mr700
+- dropped Requires: perl - rkhunter works without it 
+- dropped the bash alignpatch (check the source or contact me)
+- various file mode fixes (.../tmp/, *.db)
+- optimized the %%files section - any new files in the
+  current dirs will be fine - just %%{__install} them.
+
+* Mon Apr 26 2004 Michael Boelen - 1.0.8-0
+- Fixed missing md5blacklist.dat
+
+* Mon Apr 19 2004 Doncho N. Gunchev - 1.0.6-1.mr700
+- added missing /usr/local/rkhunter/db/md5blacklist.dat
+- patched to align results in --cronjob, I think rpm based
+  distros have symlink /bin/sh -> /bin/bash
+- added --with/--without alignpatch for conditional builds
+  (in case previous patch breaks something)
+
+* Sat Apr 03 2004 Michael Boelen / Joe Klemmer - 1.0.6-0
+- Update to 1.0.6
+
+* Mon Mar 29 2004 Doncho N. Gunchev - 1.0.0-0
+- initial .spec file
diff --git a/rkhunter.sysconfig b/rkhunter.sysconfig
new file mode 100644
index 0000000..2dacc41
--- /dev/null
+++ b/rkhunter.sysconfig
@@ -0,0 +1,10 @@
+# System configuration file for Rootkit Hunter which
+# stores RPM system specifics for cron run, etc.
+#
+#    MAILTO= <email address to send scan report>
+# DIAG_SCAN= no  - perform  normal  report scan
+#            yes - perform detailed report scan
+#                  (includes application check)
+
+MAILTO=root@localhost
+DIAG_SCAN=no
diff --git a/sources b/sources
new file mode 100644
index 0000000..6133c96
--- /dev/null
+++ b/sources
@@ -0,0 +1 @@
+89a4628c6378fdf3331d5a43b975d967  rkhunter-1.3.0.tar.gz

From 2b3ae1eba64cd8258e3c2276ee626f4ecabc513d Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Thu, 28 Feb 2008 22:00:43 +0000
Subject: [PATCH 014/122] Use /etc/redhat-release for EPEL and /etc/fedora
 release for Fedora. Add     conditionals to support EPEL Fix man page
 warning.

---
 rkhunter.spec | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 2b06545..74500ea 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.0
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -32,9 +32,13 @@ and other unwanted tools.
 	s|^#(DBDIR=).+$|$1%{_var}/%{name}/db|;
 	s|^#(SCRIPTDIR=).+$|$1%{_datadir}/%{name}/scripts|;
 	s|^#(PKGMGR=).+$|$1RPM|;
+%if 0%{?el4}%{?el5}
+	s|^#(OS_VERSION_FILE=).+$|$1/etc/redhat-release|;
+%else
 	s|^#(OS_VERSION_FILE=).+$|$1/etc/fedora-release|;
+%endif
 	s|^#(ALLOWHIDDENDIR=).+$|$1/dev/.udev|;
-	s|^#(ALLOWHIDDENDIR=).+$|$1/usr/share/man/man1/..1.gz|;
+	s|^#(ALLOWHIDDENFILE=).+$|$1/usr/share/man/man1/..1.gz|;
 	s|^(APPEND_LOG=).+$|$11|;
 	s|^(ALLOW_SSH_ROOT_USER=).+$|$1yes|;
 	s|^(DISABLE_TESTS=).+$|$1"additional_rkts suspscan hidden_procs deleted_files packet_cap_apps"|;
@@ -49,7 +53,11 @@ echo "SCRIPTWHITELIST=/usr/bin/GET" >> files/%name.conf
 echo "SCRIPTWHITELIST=/sbin/ifup" >> files/%name.conf
 echo "SCRIPTWHITELIST=/sbin/ifdown" >> files/%name.conf
 # in f8/f9
+%if 0%{?fc8}%{?fc9}
 echo "SYSLOG_CONFIG_FILE=/etc/rsyslog.conf" >> files/%name.conf
+%else
+echo "SYSLOG_CONFIG_FILE=/etc/syslog.conf" >> files/%name.conf
+%endif
 
 %{__perl} -pi.orig -e '
 	s|\@TMPDIR\@|%{_var}/%{name}/tmp|g;
@@ -134,6 +142,11 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Thu Feb 28 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.0-2
+- Use /etc/redhat-release for EPEL and /etc/fedora release for Fedora.
+- Add conditionals to support EPEL
+- Fix man page warning. 
+
 * Sun Feb 03 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.0-1
 - Revive package, clean up spec
 - Update to 1.3.0

From b203009c368a4283cc370552c8fd1dfd177a3a1b Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Fri, 29 Feb 2008 03:33:37 +0000
Subject: [PATCH 015/122] Update to 1.3.2 Fix cron script

---
 .cvsignore                     |  1 +
 01-rkhunter                    | 16 ++++++------
 rkhunter-1.3.0.sha1            | 46 --------------------------------
 rkhunter-1.3.2.tar.gz.sha1.txt | 48 ++++++++++++++++++++++++++++++++++
 rkhunter.spec                  | 23 ++++++----------
 sources                        |  2 +-
 6 files changed, 66 insertions(+), 70 deletions(-)
 create mode 100644 .cvsignore
 delete mode 100644 rkhunter-1.3.0.sha1
 create mode 100644 rkhunter-1.3.2.tar.gz.sha1.txt

diff --git a/.cvsignore b/.cvsignore
new file mode 100644
index 0000000..16c4ae9
--- /dev/null
+++ b/.cvsignore
@@ -0,0 +1 @@
+rkhunter-1.3.2.tar.gz
diff --git a/01-rkhunter b/01-rkhunter
index bde5b18..2ec467a 100755
--- a/01-rkhunter
+++ b/01-rkhunter
@@ -4,16 +4,16 @@
 XITVAL=0
 
 # Get a secure tempfile
-TMPFILE1=`/bin/mktemp -p @TMPDIR@ rkhcronlog.XXXXXXXXXX` || exit 1
+TMPFILE1=`/bin/mktemp -p /var/rkhunter/tmp rkhcronlog.XXXXXXXXXX` || exit 1
 
-if [ ! -e @STDIR@/lock/subsys/rkhunter ]; then
+if [ ! -e /var/lock/subsys/rkhunter ]; then
 
   # Try to keep the SysInit boot scan from colliding with us (highly unlikely)
-  /bin/touch @STDIR@/lock/subsys/rkhunter
+  /bin/touch /var/lock/subsys/rkhunter
 
   # Source system configuration parameters.
-  if [ -e @SCDIR@/rkhunter ] ; then
-    . @SCDIR@/rkhunter
+  if [ -e /etc/sysconfig/rkhunter ] ; then
+    . /etc/sysconfig/rkhunter
   else
     MAILTO=root@localhost
   fi
@@ -35,8 +35,8 @@ if [ ! -e @STDIR@/lock/subsys/rkhunter ]; then
   fi
 
   # Set a few critical parameters
-  RKHUNTER=@RKEXE@
-  LOGFILE=@LGDIR@/rkhunter.log
+  RKHUNTER=/usr/bin/rkhunter
+  LOGFILE=/var/log/rkhunter.log
 
   # Run RootKit Hunter if available
   if [ -x $RKHUNTER ]; then
@@ -54,7 +54,7 @@ if [ ! -e @STDIR@/lock/subsys/rkhunter ]; then
   fi
 
   # Delete the gating lockfile
-  /bin/rm -f @STDIR@/lock/subsys/rkhunter
+  /bin/rm -f /var/lock/subsys/rkhunter
 fi
 
 # Delete the secure tempfile
diff --git a/rkhunter-1.3.0.sha1 b/rkhunter-1.3.0.sha1
deleted file mode 100644
index 720767b..0000000
--- a/rkhunter-1.3.0.sha1
+++ /dev/null
@@ -1,46 +0,0 @@
-225cc53f9691ad39f10bd2aaac478355ce4dc411  rkhunter-1.3.0/files/contrib/README.txt
-285155f63cfa7a6a73ec0352dccaaa2221989b94  rkhunter-1.3.0/files/contrib/rkhunter_remote_howto.txt
-beed9c4b594c5be28ca4837fdcd2ac367e2946ee  rkhunter-1.3.0/files/contrib/run_rkhunter.sh
-e715f42bc634c5497eb83014acd8cbcbea5e4611  rkhunter-1.3.0/files/ACKNOWLEDGMENTS
-b633fb9d5dd05f68749dbf1cc268e0822f6ee4ca  rkhunter-1.3.0/files/CHANGELOG
-e7f8437125c35b69c79e1d93baa9eb205cc7f2ac  rkhunter-1.3.0/files/FAQ
-345ab306455525cf5626caadda22b5dcbf732bc1  rkhunter-1.3.0/files/LICENSE
-fc8f29a947e4345ab15d5d56280761865d61a239  rkhunter-1.3.0/files/README
-73a42c94be2fb1fd3284d8dc60d22ff0fc8407f4  rkhunter-1.3.0/files/WISHLIST
-9ddeec64999f4c0e6f9aa5992cd25c503311b764  rkhunter-1.3.0/files/backdoorports.dat
-a0badd192cc4f33fbf38f446eae3c858ba81c88f  rkhunter-1.3.0/files/check_modules.pl
-5c4319fe3f9acc552b7a9e973b7d081f7cb31642  rkhunter-1.3.0/files/check_port.pl
-996a29dee608374e601ecf0253e445e16506c672  rkhunter-1.3.0/files/check_update.sh
-59de768a09a4cd13599653df85ecc2362e416ab3  rkhunter-1.3.0/files/defaulthashes.dat
-ebc05604eb51b10478d35ac3750699cefecd5ae3  rkhunter-1.3.0/files/filehashmd5.pl
-1878119b6045eeab6a5afaebad7b523e86c3a935  rkhunter-1.3.0/files/filehashsha1.pl
-82c8c3881d59d228de3ce74a4b7b68eac07940f1  rkhunter-1.3.0/files/md5blacklist.dat
-a656a91b37a83a2325843f0ccedb5eb7866506ac  rkhunter-1.3.0/files/mirrors.dat
-951b498f71fc4a126ca435f7bce96ed8b821efb6  rkhunter-1.3.0/files/os.dat
-c82074175e72642dd74322ce29281f0f2fe2798c  rkhunter-1.3.0/files/programs_bad.dat
-d5bff919ce44a345a193824ea16b0404008d7823  rkhunter-1.3.0/files/programs_good.dat
-d824c9ca8b591d108bd7b194350166ac65e64212  rkhunter-1.3.0/files/readlink.sh
-41fa7cdcd45fc96d730c1e54a0eb40d4d4c2c428  rkhunter-1.3.0/files/rkhunter
-7098a383b12612e1cf7191963e039936fc788ba0  rkhunter-1.3.0/files/rkhunter.8
-ad8112c0678b56d652857ec933bf6b60145045f7  rkhunter-1.3.0/files/rkhunter.conf
-eb5d6ef0c5cd9dec13a98c66ab82e1ccae62121f  rkhunter-1.3.0/files/rkhunter.spec
-43bca835d9c64ab2f8cf7f1a5a078bb1b7da9306  rkhunter-1.3.0/files/showfiles.pl
-5dfa5246dc1c87b05f44f9f444466ce3d0d6edec  rkhunter-1.3.0/files/stat.pl
-ec4d60774decbb354f7aafcc2b65b1f87e000c97  rkhunter-1.3.0/files/suspscan.dat
-e158163bfe6cb414d839e91880af37611f8b5cc0  rkhunter-1.3.0/files/development/createfilehashes.pl
-cb4903c649ad50b79230f5a5250da82c1d9ccb0f  rkhunter-1.3.0/files/development/createhashes.sh
-6b2f032d6143ed3b6ba3eae19d7921e154e69e47  rkhunter-1.3.0/files/development/createhashesall.sh
-d09ab61a3563122b8cd6415e3083dfe1ef285a2b  rkhunter-1.3.0/files/development/i18nchk
-0c613880f3447af695ca9f9f93e158b34c2a10c3  rkhunter-1.3.0/files/development/osinformation.sh
-614a5d3999055a8faeecc393c5695d628e5a7675  rkhunter-1.3.0/files/development/rpmhashes.sh
-4f4dfb87e758236cadc5ac5af67bbb35f4f63eb1  rkhunter-1.3.0/files/development/rpmprelinkhashes.sh
-7378fb7e91b1f7e789508e4e8d00e1e3a70ee6ff  rkhunter-1.3.0/files/development/search_dead_sysmlinks.sh
-52ac2bcbe9524971cc535b20fb6d3442f53ea8b0  rkhunter-1.3.0/files/i18n/cn
-a36507f61ba0932774bfaed58708edb8ded567dd  rkhunter-1.3.0/files/i18n/en
-73e76916a3f65dde2317fff6c932e1d77760fdf7  rkhunter-1.3.0/files/testing/rkhunter.conf
-361ada5406c7e57e62e840caf3d3bce5e8436fc1  rkhunter-1.3.0/files/testing/rootkitinfo.txt
-56bf42d4fe669412b84eb307d5e314af4501dc9a  rkhunter-1.3.0/files/testing/stringscanner.sh
-ff10891d252f3859abe63054eb64f0e9eae2d781  rkhunter-1.3.0/files/tools/README
-90876286c511986474144a5a1fc21afa0f5f29c5  rkhunter-1.3.0/files/tools/update_client.sh
-e3ba269e33d5d385230d0a4457d87cf6e3acece8  rkhunter-1.3.0/files/tools/update_server.sh
-737e3663adbd1f36eab4b668a16462da3278c04d  rkhunter-1.3.0/installer.sh
diff --git a/rkhunter-1.3.2.tar.gz.sha1.txt b/rkhunter-1.3.2.tar.gz.sha1.txt
new file mode 100644
index 0000000..6a9bf4d
--- /dev/null
+++ b/rkhunter-1.3.2.tar.gz.sha1.txt
@@ -0,0 +1,48 @@
+5dfa5246dc1c87b05f44f9f444466ce3d0d6edec  rkhunter-1.3.2/files/stat.pl
+73a42c94be2fb1fd3284d8dc60d22ff0fc8407f4  rkhunter-1.3.2/files/WISHLIST
+5c4319fe3f9acc552b7a9e973b7d081f7cb31642  rkhunter-1.3.2/files/check_port.pl
+56bf42d4fe669412b84eb307d5e314af4501dc9a  rkhunter-1.3.2/files/testing/stringscanner.sh
+361ada5406c7e57e62e840caf3d3bce5e8436fc1  rkhunter-1.3.2/files/testing/rootkitinfo.txt
+73e76916a3f65dde2317fff6c932e1d77760fdf7  rkhunter-1.3.2/files/testing/rkhunter.conf
+345ab306455525cf5626caadda22b5dcbf732bc1  rkhunter-1.3.2/files/LICENSE
+cb4903c649ad50b79230f5a5250da82c1d9ccb0f  rkhunter-1.3.2/files/development/createhashes.sh
+e158163bfe6cb414d839e91880af37611f8b5cc0  rkhunter-1.3.2/files/development/createfilehashes.pl
+7378fb7e91b1f7e789508e4e8d00e1e3a70ee6ff  rkhunter-1.3.2/files/development/search_dead_sysmlinks.sh
+0c613880f3447af695ca9f9f93e158b34c2a10c3  rkhunter-1.3.2/files/development/osinformation.sh
+4f4dfb87e758236cadc5ac5af67bbb35f4f63eb1  rkhunter-1.3.2/files/development/rpmprelinkhashes.sh
+d09ab61a3563122b8cd6415e3083dfe1ef285a2b  rkhunter-1.3.2/files/development/i18nchk
+6b2f032d6143ed3b6ba3eae19d7921e154e69e47  rkhunter-1.3.2/files/development/createhashesall.sh
+614a5d3999055a8faeecc393c5695d628e5a7675  rkhunter-1.3.2/files/development/rpmhashes.sh
+ebc05604eb51b10478d35ac3750699cefecd5ae3  rkhunter-1.3.2/files/filehashmd5.pl
+736fd9ea453f34c023a9ebed97fa0cea7461aeb8  rkhunter-1.3.2/files/i18n/zh.utf8
+52ac2bcbe9524971cc535b20fb6d3442f53ea8b0  rkhunter-1.3.2/files/i18n/cn
+3aa3999bd924382f2a7b7e52ad0c3f7834d2285c  rkhunter-1.3.2/files/i18n/zh
+02e945d8a260275e118064080767db349fe576ef  rkhunter-1.3.2/files/i18n/en
+a656a91b37a83a2325843f0ccedb5eb7866506ac  rkhunter-1.3.2/files/mirrors.dat
+1878119b6045eeab6a5afaebad7b523e86c3a935  rkhunter-1.3.2/files/filehashsha1.pl
+9ddeec64999f4c0e6f9aa5992cd25c503311b764  rkhunter-1.3.2/files/backdoorports.dat
+82c8c3881d59d228de3ce74a4b7b68eac07940f1  rkhunter-1.3.2/files/md5blacklist.dat
+e3ba269e33d5d385230d0a4457d87cf6e3acece8  rkhunter-1.3.2/files/tools/update_server.sh
+90876286c511986474144a5a1fc21afa0f5f29c5  rkhunter-1.3.2/files/tools/update_client.sh
+ff10891d252f3859abe63054eb64f0e9eae2d781  rkhunter-1.3.2/files/tools/README
+ec4d60774decbb354f7aafcc2b65b1f87e000c97  rkhunter-1.3.2/files/suspscan.dat
+7fa41ed0dc8c95b48b04dab42f1eaf8031c6ce7c  rkhunter-1.3.2/files/ACKNOWLEDGMENTS
+70fac95d14f77a3917c60f368edbfb9d90ce77c0  rkhunter-1.3.2/files/CHANGELOG
+951b498f71fc4a126ca435f7bce96ed8b821efb6  rkhunter-1.3.2/files/os.dat
+996a29dee608374e601ecf0253e445e16506c672  rkhunter-1.3.2/files/check_update.sh
+e651578a9556934bee10621b99297bbd6ccec273  rkhunter-1.3.2/files/rkhunter
+575f460146ef61beeda2733f2e3f82c61909d3a8  rkhunter-1.3.2/files/rkhunter.conf
+6753f47a54fdfad483fe06ad68dd47161f5efa45  rkhunter-1.3.2/files/rkhunter.8
+a0b8900db1484a34f0505bf90b5a07fb38433151  rkhunter-1.3.2/files/rkhunter.spec
+897aecb909610d8c2b967fffba4f9626416789fb  rkhunter-1.3.2/files/README
+d824c9ca8b591d108bd7b194350166ac65e64212  rkhunter-1.3.2/files/readlink.sh
+c82074175e72642dd74322ce29281f0f2fe2798c  rkhunter-1.3.2/files/programs_bad.dat
+d5bff919ce44a345a193824ea16b0404008d7823  rkhunter-1.3.2/files/programs_good.dat
+59de768a09a4cd13599653df85ecc2362e416ab3  rkhunter-1.3.2/files/defaulthashes.dat
+43bca835d9c64ab2f8cf7f1a5a078bb1b7da9306  rkhunter-1.3.2/files/showfiles.pl
+286d1c1fcfa924d63583ae961382250724ac9599  rkhunter-1.3.2/files/FAQ
+a0badd192cc4f33fbf38f446eae3c858ba81c88f  rkhunter-1.3.2/files/check_modules.pl
+285155f63cfa7a6a73ec0352dccaaa2221989b94  rkhunter-1.3.2/files/contrib/rkhunter_remote_howto.txt
+beed9c4b594c5be28ca4837fdcd2ac367e2946ee  rkhunter-1.3.2/files/contrib/run_rkhunter.sh
+225cc53f9691ad39f10bd2aaac478355ce4dc411  rkhunter-1.3.2/files/contrib/README.txt
+1b37e37eb80b4d7fd97b3d4e7f3711d3c4a335f4  rkhunter-1.3.2/installer.sh
diff --git a/rkhunter.spec b/rkhunter.spec
index 74500ea..1bfde8d 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,13 +1,13 @@
 Name:           rkhunter
-Version:        1.3.0
-Release:        2%{?dist}
+Version:        1.3.2
+Release:        1%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
 License:        GPLv2+
 URL:            http://rkhunter.sourceforge.net/
-Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.0.tar.gz
-Source1:        http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.0.sha1
+Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.2.tar.gz
+Source1:        http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.2.tar.gz.sha1.txt
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
 BuildArch:      noarch
@@ -59,17 +59,6 @@ echo "SYSLOG_CONFIG_FILE=/etc/rsyslog.conf" >> files/%name.conf
 echo "SYSLOG_CONFIG_FILE=/etc/syslog.conf" >> files/%name.conf
 %endif
 
-%{__perl} -pi.orig -e '
-	s|\@TMPDIR\@|%{_var}/%{name}/tmp|g;
-	s|\@STDIR\@|%{_localstatedir}|g;
-	s|\@CFGDIR\@|%{_sysconfdir}|g;
-	s|\@SCDIR\@|%{_sysconfdir}/sysconfig|g;
-	s|\@ITDIR\@|%{_initrddir}|g;
-	s|\@RKEXE\@|%{_bindir}/%{name}|g;
-	s|\@RKHSH\@|%{_bindir}/%{name}-scan.sh|g;
-	s|\@LGDIR\@|%{_localstatedir}/log|g;
-    ' 01-%{name}
-
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}.log {
     weekly
@@ -142,6 +131,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Thu Feb 28 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-1
+- Update to 1.3.2
+- Fix cron script
+
 * Thu Feb 28 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.0-2
 - Use /etc/redhat-release for EPEL and /etc/fedora release for Fedora.
 - Add conditionals to support EPEL
diff --git a/sources b/sources
index 6133c96..a9725b9 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-89a4628c6378fdf3331d5a43b975d967  rkhunter-1.3.0.tar.gz
+a00ff64d7076d6ff47ef0c9f0b6202f2  rkhunter-1.3.2.tar.gz

From ab1f37303a7bc6f25d19682189e2dc094233fbc6 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Thu, 27 Mar 2008 04:02:39 +0000
Subject: [PATCH 016/122] Move things to more standard locations for selinux -
 bug #438184 Add     exception for pulseaudio file - bug #438622

---
 01-rkhunter   | 17 ++++-------------
 rkhunter.spec | 47 ++++++++++++++++++++++++++++-------------------
 2 files changed, 32 insertions(+), 32 deletions(-)

diff --git a/01-rkhunter b/01-rkhunter
index 2ec467a..dc2addd 100755
--- a/01-rkhunter
+++ b/01-rkhunter
@@ -4,7 +4,7 @@
 XITVAL=0
 
 # Get a secure tempfile
-TMPFILE1=`/bin/mktemp -p /var/rkhunter/tmp rkhcronlog.XXXXXXXXXX` || exit 1
+TMPFILE1=`/bin/mktemp -p /var/run/rkhunter rkhcronlog.XXXXXXXXXX` || exit 1
 
 if [ ! -e /var/lock/subsys/rkhunter ]; then
 
@@ -20,23 +20,14 @@ if [ ! -e /var/lock/subsys/rkhunter ]; then
 
   # If a diagnostic mode scan was requested, setup the parameters
   if [ "$DIAG_SCAN" == "yes" ]; then
-    RKHUNTER_FLAGS="
-    --checkall
-    --run-application-check
-    --skip-keypress
-    --nocolors
-    --quiet
-    --append-log $TMPFILE1
-  "
+    RKHUNTER_FLAGS="--checkall --skip-keypress --nocolors --quiet --appendlog --display-logfile"
   else
-    RKHUNTER_FLAGS="
-    --cronjob
-  "
+    RKHUNTER_FLAGS="--cronjob --report-warnings-only"
   fi
 
   # Set a few critical parameters
   RKHUNTER=/usr/bin/rkhunter
-  LOGFILE=/var/log/rkhunter.log
+  LOGFILE=/var/log/rkhunter/rkhunter.log
 
   # Run RootKit Hunter if available
   if [ -x $RKHUNTER ]; then
diff --git a/rkhunter.spec b/rkhunter.spec
index 1bfde8d..50deac8 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.2
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -28,8 +28,8 @@ and other unwanted tools.
 
 %{__perl} -pi.0001 -e '
 	s|^#(MAIL-ON-WARNING=).+$|$1root\@localhost|;
-	s|^#(TMPDIR=).+$|$1%{_var}/%{name}/tmp|;
-	s|^#(DBDIR=).+$|$1%{_var}/%{name}/db|;
+	s|^#(TMPDIR=).+$|$1%{_var}/run/%{name}|;
+	s|^#(DBDIR=).+$|$1%{_var}/lib/%{name}/db|;
 	s|^#(SCRIPTDIR=).+$|$1%{_datadir}/%{name}/scripts|;
 	s|^#(PKGMGR=).+$|$1RPM|;
 %if 0%{?el4}%{?el5}
@@ -40,6 +40,7 @@ and other unwanted tools.
 	s|^#(ALLOWHIDDENDIR=).+$|$1/dev/.udev|;
 	s|^#(ALLOWHIDDENFILE=).+$|$1/usr/share/man/man1/..1.gz|;
 	s|^(APPEND_LOG=).+$|$11|;
+	s|^(LOGFILE=).+$|$1/var/log/rkhunter/rkhunter.log|;
 	s|^(ALLOW_SSH_ROOT_USER=).+$|$1yes|;
 	s|^(DISABLE_TESTS=).+$|$1"additional_rkts suspscan hidden_procs deleted_files packet_cap_apps"|;
     ' files/%{name}.conf
@@ -55,12 +56,13 @@ echo "SCRIPTWHITELIST=/sbin/ifdown" >> files/%name.conf
 # in f8/f9
 %if 0%{?fc8}%{?fc9}
 echo "SYSLOG_CONFIG_FILE=/etc/rsyslog.conf" >> files/%name.conf
+echo "ALLOWDEVFILE=/dev/shm/pulse-shm-*" >> files/%name.conf
 %else
 echo "SYSLOG_CONFIG_FILE=/etc/syslog.conf" >> files/%name.conf
 %endif
 
 %{__cat} <<'EOF' >%{name}.logrotate
-%{_localstatedir}/log/%{name}.log {
+%{_localstatedir}/log/%{name}/%{name}.log {
     weekly
     notifempty
     create 640 root root
@@ -78,20 +80,22 @@ EOF
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8
-%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/%{name}/{db,tmp}
-%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/%{name}/db/i18n
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/run/%{name}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/log/%{name}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n
 
 %{__install} -m755 -p files/%{name}             ${RPM_BUILD_ROOT}%{_bindir}/
 
-%{__install} -m644 -p files/backdoorports.dat   ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
-%{__install} -m644 -p files/defaulthashes.dat   ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
-%{__install} -m644 -p files/md5blacklist.dat    ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
-%{__install} -m644 -p files/mirrors.dat         ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
-%{__install} -m644 -p files/os.dat              ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
-%{__install} -m644 -p files/programs_bad.dat    ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
-%{__install} -m644 -p files/programs_good.dat   ${RPM_BUILD_ROOT}%{_var}/%{name}/db/
-%{__install} -m644 -p files/i18n/cn             ${RPM_BUILD_ROOT}%{_var}/%{name}/db/i18n/
-%{__install} -m644 -p files/i18n/en             ${RPM_BUILD_ROOT}%{_var}/%{name}/db/i18n/
+%{__install} -m644 -p files/backdoorports.dat   ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
+%{__install} -m644 -p files/defaulthashes.dat   ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
+%{__install} -m644 -p files/md5blacklist.dat    ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
+%{__install} -m644 -p files/mirrors.dat         ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
+%{__install} -m644 -p files/os.dat              ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
+%{__install} -m644 -p files/programs_bad.dat    ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
+%{__install} -m644 -p files/programs_good.dat   ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
+%{__install} -m644 -p files/i18n/cn             ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n/
+%{__install} -m644 -p files/i18n/en             ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n/
 
 %{__install} -m644 -p files/CHANGELOG           ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
 %{__install} -m644 -p files/LICENSE             ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
@@ -121,16 +125,21 @@ EOF
 %{_datadir}/%{name}/scripts
 %{_sysconfdir}/cron.daily/01-%{name}
 %config(noreplace) %{_sysconfdir}/logrotate.d/%{name}
-%dir %{_var}/%{name}
-%{_var}/%{name}/db
-%{_var}/%{name}/db/i18n
-%dir %{_var}/%{name}/tmp
+%dir %{_var}/lib/%{name}
+%{_var}/lib/%{name}/db
+%{_var}/lib/%{name}/db/i18n
+%dir %{_var}/run/%{name}
+%dir %{_var}/log/%{name}
 %config(noreplace) %{_sysconfdir}/%{name}.conf
 %config(noreplace) %{_sysconfdir}/sysconfig/%{name}
 %dir %{_docdir}/%{name}-%{version}
 %{_mandir}/man8/*
 
 %changelog
+* Wed Mar 26 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-2
+- Move things to more standard locations for selinux - bug #438184
+- Add exception for pulseaudio file - bug #438622
+
 * Thu Feb 28 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-1
 - Update to 1.3.2
 - Fix cron script

From c2bfdc693dc7bce6b2730f5bc50d4d37fc4a6fcd Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Sat, 17 May 2008 21:02:36 +0000
Subject: [PATCH 017/122] Change cron to run after prelink - bug #438622

---
 rkhunter.spec | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 50deac8..daf763d 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.2
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -109,7 +109,7 @@ EOF
 #%{__install} -m750 -p files/filehashmd5.pl      ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
 #%{__install} -m750 -p files/filehashsha1.pl     ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
 %{__install} -m755 -p files/showfiles.pl        ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/
-%{__install} -m755 -p %{SOURCE2}                ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/
+%{__install} -m755 -p %{SOURCE2}                ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/%{name}
 %{__install} -m644 -p %{name}.logrotate         ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/%{name}
 %{__install} -m640 -p files/%{name}.conf        ${RPM_BUILD_ROOT}%{_sysconfdir}/
 %{__install} -m640 -p %{SOURCE3}                ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name}
@@ -123,7 +123,7 @@ EOF
 %{_bindir}/%{name}
 %dir %{_datadir}/%{name}
 %{_datadir}/%{name}/scripts
-%{_sysconfdir}/cron.daily/01-%{name}
+%{_sysconfdir}/cron.daily/%{name}
 %config(noreplace) %{_sysconfdir}/logrotate.d/%{name}
 %dir %{_var}/lib/%{name}
 %{_var}/lib/%{name}/db
@@ -136,6 +136,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Mon Apr 28 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-3
+- Change cron to run after prelink - bug #438622
+
 * Wed Mar 26 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-2
 - Move things to more standard locations for selinux - bug #438184
 - Add exception for pulseaudio file - bug #438622

From 58d56245816f79768c8120082586f54ec41c98f7 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Tue, 17 Jun 2008 18:48:04 +0000
Subject: [PATCH 018/122] Fix cron script to only mail on warn/error - bug
 #450703 Fix conditional to     account for fc10 rsyslog

---
 01-rkhunter   |  5 ++++-
 rkhunter.spec | 10 +++++++---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/01-rkhunter b/01-rkhunter
index dc2addd..dacf61d 100755
--- a/01-rkhunter
+++ b/01-rkhunter
@@ -40,7 +40,10 @@ if [ ! -e /var/lock/subsys/rkhunter ]; then
     XITVAL=$?
     /bin/echo -e "\n----------------------- End Rootkit Hunter Scan -----------------------" \
       >> $TMPFILE1
-    /bin/cat $TMPFILE1 | /bin/mail -s 'rkhunter Daily Run' $MAILTO
+
+    if [ $XITVAL != 0 ]; then
+         /bin/cat $TMPFILE1 | /bin/mail -s 'rkhunter Daily Run' $MAILTO
+    fi
     /bin/cat $TMPFILE1 >> $LOGFILE
   fi
 
diff --git a/rkhunter.spec b/rkhunter.spec
index daf763d..91fb034 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.2
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -53,8 +53,8 @@ echo "SCRIPTWHITELIST=/usr/bin/groups" >> files/%name.conf
 echo "SCRIPTWHITELIST=/usr/bin/GET" >> files/%name.conf
 echo "SCRIPTWHITELIST=/sbin/ifup" >> files/%name.conf
 echo "SCRIPTWHITELIST=/sbin/ifdown" >> files/%name.conf
-# in f8/f9
-%if 0%{?fc8}%{?fc9}
+# in f8/f9/f10
+%if 0%{?fc8}%{?fc9}%{?fc10}
 echo "SYSLOG_CONFIG_FILE=/etc/rsyslog.conf" >> files/%name.conf
 echo "ALLOWDEVFILE=/dev/shm/pulse-shm-*" >> files/%name.conf
 %else
@@ -136,6 +136,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Mon Jun 16 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-4
+- Fix cron script to only mail on warn/error - bug #450703
+- Fix conditional to account for fc10 rsyslog
+
 * Mon Apr 28 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-3
 - Change cron to run after prelink - bug #438622
 

From e27465b38ed49c2ddb947e0a061e54efca186d37 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Mon, 15 Sep 2008 21:55:21 +0000
Subject: [PATCH 019/122] Patch debug tmp file issue - bug #460628

---
 rkhunter-1.3.2-debugtmp.patch | 34 ++++++++++++++++++++++++++++++++++
 rkhunter.spec                 |  8 +++++++-
 2 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 rkhunter-1.3.2-debugtmp.patch

diff --git a/rkhunter-1.3.2-debugtmp.patch b/rkhunter-1.3.2-debugtmp.patch
new file mode 100644
index 0000000..662d222
--- /dev/null
+++ b/rkhunter-1.3.2-debugtmp.patch
@@ -0,0 +1,34 @@
+diff -Nur rkhunter-1.3.2.orig/files/rkhunter rkhunter-1.3.2/files/rkhunter
+--- rkhunter-1.3.2.orig/files/rkhunter	2008-02-27 08:59:22.000000000 -0700
++++ rkhunter-1.3.2/files/rkhunter	2008-08-31 10:22:20.000000000 -0600
+@@ -41,18 +41,18 @@
+ fi
+ 
+ if [ "$1" = "--debug" ]; then
+-	if [ -e "/tmp/rkhunter-debug" ]; then
+-		if [ -f "/tmp/rkhunter-debug" -a ! -h "/tmp/rkhunter-debug" ]; then
+-			rm -f /tmp/rkhunter-debug >/dev/null 2>&1
+-		else
+-			echo "Cannot use '--debug' option. /tmp/rkhunter-debug already exists, but it is not a file."
+-			exit 1
+-		fi
+-	fi
+-
+-	DEBUG_OPT=1
+-
+-	exec 1>/tmp/rkhunter-debug 2>&1
++      DEBUG_FILE=`mktemp -t rkhunter-debug.XXXXXXXXXX`
++      if [ -e "$DEBUG_FILE" ]; then
++              if [ -f "$DEBUG_FILE" -a ! -h "$DEBUG_FILE" ]; then
++                      rm -f $DEBUG_FILE >/dev/null 2>&1
++              else
++                      echo "Cannot use '--debug' option. $DEBUG_FILE already exists, but it is not a file."
++                       exit 1
++               fi
++        fi
++ 
++        DEBUG_OPT=1
++        exec 1>$DEBUG_FILE 2>&1
+ 	set -x
+ else
+ 	DEBUG_OPT=0
diff --git a/rkhunter.spec b/rkhunter.spec
index 91fb034..03d8ca7 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.2
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -10,6 +10,7 @@ Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.2.tar.gz
 Source1:        http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.2.tar.gz.sha1.txt
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
+Patch0:		rkhunter-1.3.2-debugtmp.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -69,6 +70,8 @@ echo "SYSLOG_CONFIG_FILE=/etc/syslog.conf" >> files/%name.conf
 }
 EOF
 
+%patch0 -p1
+
 %build
 # Nothing to be built
 
@@ -136,6 +139,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Sep 03 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-5
+- Patch debug tmp file issue - bug #460628
+
 * Mon Jun 16 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-4
 - Fix cron script to only mail on warn/error - bug #450703
 - Fix conditional to account for fc10 rsyslog

From 3821afc2917bfdd7e5d4382b8c642448a3acac2b Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Sun, 14 Dec 2008 01:20:11 +0000
Subject: [PATCH 020/122] Fix cron job sending as attachment - bug #472679 Fix
 cron job trying to     send with colors - bug #475916

---
 01-rkhunter   | 4 ++--
 rkhunter.spec | 6 +++++-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/01-rkhunter b/01-rkhunter
index dacf61d..0d0cce9 100755
--- a/01-rkhunter
+++ b/01-rkhunter
@@ -22,7 +22,7 @@ if [ ! -e /var/lock/subsys/rkhunter ]; then
   if [ "$DIAG_SCAN" == "yes" ]; then
     RKHUNTER_FLAGS="--checkall --skip-keypress --nocolors --quiet --appendlog --display-logfile"
   else
-    RKHUNTER_FLAGS="--cronjob --report-warnings-only"
+    RKHUNTER_FLAGS="--cronjob --nocolors --report-warnings-only"
   fi
 
   # Set a few critical parameters
@@ -33,7 +33,7 @@ if [ ! -e /var/lock/subsys/rkhunter ]; then
   if [ -x $RKHUNTER ]; then
     /bin/echo -e "\n--------------------- Start Rootkit Hunter Update ---------------------" \
       > $TMPFILE1
-    /bin/nice -n 10 $RKHUNTER --update 2>&1 >> $TMPFILE1
+    /bin/nice -n 10 $RKHUNTER --update --nocolors 2>&1 >> $TMPFILE1
     /bin/echo -e "\n---------------------- Start Rootkit Hunter Scan ----------------------" \
       >> $TMPFILE1
     /bin/nice -n 10 $RKHUNTER $RKHUNTER_FLAGS 2>&1 >> $TMPFILE1
diff --git a/rkhunter.spec b/rkhunter.spec
index 03d8ca7..a6534aa 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.2
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -139,6 +139,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Dec 13 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-6
+- Fix cron job sending as attachment - bug #472679
+- Fix cron job trying to send with colors - bug #475916
+
 * Wed Sep 03 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-5
 - Patch debug tmp file issue - bug #460628
 

From f7dfb5dc05bbfc666d5f8873d9f460718eb3aa96 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Fri, 2 Jan 2009 23:29:21 +0000
Subject: [PATCH 021/122] Update to 1.3.4 Use libdir as tmp dir - bug #456340

---
 .cvsignore                    |  2 +-
 rkhunter-1.3.2-debugtmp.patch | 34 ----------------------------------
 rkhunter.spec                 | 17 +++++++++--------
 sources                       |  2 +-
 4 files changed, 11 insertions(+), 44 deletions(-)
 delete mode 100644 rkhunter-1.3.2-debugtmp.patch

diff --git a/.cvsignore b/.cvsignore
index 16c4ae9..3c9d62b 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1 +1 @@
-rkhunter-1.3.2.tar.gz
+rkhunter-1.3.4.tar.gz
diff --git a/rkhunter-1.3.2-debugtmp.patch b/rkhunter-1.3.2-debugtmp.patch
deleted file mode 100644
index 662d222..0000000
--- a/rkhunter-1.3.2-debugtmp.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-diff -Nur rkhunter-1.3.2.orig/files/rkhunter rkhunter-1.3.2/files/rkhunter
---- rkhunter-1.3.2.orig/files/rkhunter	2008-02-27 08:59:22.000000000 -0700
-+++ rkhunter-1.3.2/files/rkhunter	2008-08-31 10:22:20.000000000 -0600
-@@ -41,18 +41,18 @@
- fi
- 
- if [ "$1" = "--debug" ]; then
--	if [ -e "/tmp/rkhunter-debug" ]; then
--		if [ -f "/tmp/rkhunter-debug" -a ! -h "/tmp/rkhunter-debug" ]; then
--			rm -f /tmp/rkhunter-debug >/dev/null 2>&1
--		else
--			echo "Cannot use '--debug' option. /tmp/rkhunter-debug already exists, but it is not a file."
--			exit 1
--		fi
--	fi
--
--	DEBUG_OPT=1
--
--	exec 1>/tmp/rkhunter-debug 2>&1
-+      DEBUG_FILE=`mktemp -t rkhunter-debug.XXXXXXXXXX`
-+      if [ -e "$DEBUG_FILE" ]; then
-+              if [ -f "$DEBUG_FILE" -a ! -h "$DEBUG_FILE" ]; then
-+                      rm -f $DEBUG_FILE >/dev/null 2>&1
-+              else
-+                      echo "Cannot use '--debug' option. $DEBUG_FILE already exists, but it is not a file."
-+                       exit 1
-+               fi
-+        fi
-+ 
-+        DEBUG_OPT=1
-+        exec 1>$DEBUG_FILE 2>&1
- 	set -x
- else
- 	DEBUG_OPT=0
diff --git a/rkhunter.spec b/rkhunter.spec
index a6534aa..fe651a7 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,16 +1,15 @@
 Name:           rkhunter
-Version:        1.3.2
-Release:        6%{?dist}
+Version:        1.3.4
+Release:        1%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
 License:        GPLv2+
 URL:            http://rkhunter.sourceforge.net/
-Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.2.tar.gz
-Source1:        http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.2.tar.gz.sha1.txt
+Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz
+Source1:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz.sha1.txt
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
-Patch0:		rkhunter-1.3.2-debugtmp.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -29,7 +28,7 @@ and other unwanted tools.
 
 %{__perl} -pi.0001 -e '
 	s|^#(MAIL-ON-WARNING=).+$|$1root\@localhost|;
-	s|^#(TMPDIR=).+$|$1%{_var}/run/%{name}|;
+	s|^#(TMPDIR=).+$|$1%{_var}/lib/%{name}|;
 	s|^#(DBDIR=).+$|$1%{_var}/lib/%{name}/db|;
 	s|^#(SCRIPTDIR=).+$|$1%{_datadir}/%{name}/scripts|;
 	s|^#(PKGMGR=).+$|$1RPM|;
@@ -70,8 +69,6 @@ echo "SYSLOG_CONFIG_FILE=/etc/syslog.conf" >> files/%name.conf
 }
 EOF
 
-%patch0 -p1
-
 %build
 # Nothing to be built
 
@@ -139,6 +136,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jan 02 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-1
+- Update to 1.3.4
+- Use libdir as tmp dir - bug #456340
+
 * Sat Dec 13 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-6
 - Fix cron job sending as attachment - bug #472679
 - Fix cron job trying to send with colors - bug #475916
diff --git a/sources b/sources
index a9725b9..72d4d0e 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-a00ff64d7076d6ff47ef0c9f0b6202f2  rkhunter-1.3.2.tar.gz
+31eaacc4d01ad138d1a4283f105088e6  rkhunter-1.3.4.tar.gz

From 3ac2c5d643bc7f158de2222d10b68b53d0dcb35f Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Fri, 2 Jan 2009 23:36:57 +0000
Subject: [PATCH 022/122] Commit new sha1.txt file

---
 rkhunter-1.3.2.tar.gz.sha1.txt | 48 ----------------------------------
 rkhunter-1.3.4.tar.gz.sha1.txt | 48 ++++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 48 deletions(-)
 delete mode 100644 rkhunter-1.3.2.tar.gz.sha1.txt
 create mode 100644 rkhunter-1.3.4.tar.gz.sha1.txt

diff --git a/rkhunter-1.3.2.tar.gz.sha1.txt b/rkhunter-1.3.2.tar.gz.sha1.txt
deleted file mode 100644
index 6a9bf4d..0000000
--- a/rkhunter-1.3.2.tar.gz.sha1.txt
+++ /dev/null
@@ -1,48 +0,0 @@
-5dfa5246dc1c87b05f44f9f444466ce3d0d6edec  rkhunter-1.3.2/files/stat.pl
-73a42c94be2fb1fd3284d8dc60d22ff0fc8407f4  rkhunter-1.3.2/files/WISHLIST
-5c4319fe3f9acc552b7a9e973b7d081f7cb31642  rkhunter-1.3.2/files/check_port.pl
-56bf42d4fe669412b84eb307d5e314af4501dc9a  rkhunter-1.3.2/files/testing/stringscanner.sh
-361ada5406c7e57e62e840caf3d3bce5e8436fc1  rkhunter-1.3.2/files/testing/rootkitinfo.txt
-73e76916a3f65dde2317fff6c932e1d77760fdf7  rkhunter-1.3.2/files/testing/rkhunter.conf
-345ab306455525cf5626caadda22b5dcbf732bc1  rkhunter-1.3.2/files/LICENSE
-cb4903c649ad50b79230f5a5250da82c1d9ccb0f  rkhunter-1.3.2/files/development/createhashes.sh
-e158163bfe6cb414d839e91880af37611f8b5cc0  rkhunter-1.3.2/files/development/createfilehashes.pl
-7378fb7e91b1f7e789508e4e8d00e1e3a70ee6ff  rkhunter-1.3.2/files/development/search_dead_sysmlinks.sh
-0c613880f3447af695ca9f9f93e158b34c2a10c3  rkhunter-1.3.2/files/development/osinformation.sh
-4f4dfb87e758236cadc5ac5af67bbb35f4f63eb1  rkhunter-1.3.2/files/development/rpmprelinkhashes.sh
-d09ab61a3563122b8cd6415e3083dfe1ef285a2b  rkhunter-1.3.2/files/development/i18nchk
-6b2f032d6143ed3b6ba3eae19d7921e154e69e47  rkhunter-1.3.2/files/development/createhashesall.sh
-614a5d3999055a8faeecc393c5695d628e5a7675  rkhunter-1.3.2/files/development/rpmhashes.sh
-ebc05604eb51b10478d35ac3750699cefecd5ae3  rkhunter-1.3.2/files/filehashmd5.pl
-736fd9ea453f34c023a9ebed97fa0cea7461aeb8  rkhunter-1.3.2/files/i18n/zh.utf8
-52ac2bcbe9524971cc535b20fb6d3442f53ea8b0  rkhunter-1.3.2/files/i18n/cn
-3aa3999bd924382f2a7b7e52ad0c3f7834d2285c  rkhunter-1.3.2/files/i18n/zh
-02e945d8a260275e118064080767db349fe576ef  rkhunter-1.3.2/files/i18n/en
-a656a91b37a83a2325843f0ccedb5eb7866506ac  rkhunter-1.3.2/files/mirrors.dat
-1878119b6045eeab6a5afaebad7b523e86c3a935  rkhunter-1.3.2/files/filehashsha1.pl
-9ddeec64999f4c0e6f9aa5992cd25c503311b764  rkhunter-1.3.2/files/backdoorports.dat
-82c8c3881d59d228de3ce74a4b7b68eac07940f1  rkhunter-1.3.2/files/md5blacklist.dat
-e3ba269e33d5d385230d0a4457d87cf6e3acece8  rkhunter-1.3.2/files/tools/update_server.sh
-90876286c511986474144a5a1fc21afa0f5f29c5  rkhunter-1.3.2/files/tools/update_client.sh
-ff10891d252f3859abe63054eb64f0e9eae2d781  rkhunter-1.3.2/files/tools/README
-ec4d60774decbb354f7aafcc2b65b1f87e000c97  rkhunter-1.3.2/files/suspscan.dat
-7fa41ed0dc8c95b48b04dab42f1eaf8031c6ce7c  rkhunter-1.3.2/files/ACKNOWLEDGMENTS
-70fac95d14f77a3917c60f368edbfb9d90ce77c0  rkhunter-1.3.2/files/CHANGELOG
-951b498f71fc4a126ca435f7bce96ed8b821efb6  rkhunter-1.3.2/files/os.dat
-996a29dee608374e601ecf0253e445e16506c672  rkhunter-1.3.2/files/check_update.sh
-e651578a9556934bee10621b99297bbd6ccec273  rkhunter-1.3.2/files/rkhunter
-575f460146ef61beeda2733f2e3f82c61909d3a8  rkhunter-1.3.2/files/rkhunter.conf
-6753f47a54fdfad483fe06ad68dd47161f5efa45  rkhunter-1.3.2/files/rkhunter.8
-a0b8900db1484a34f0505bf90b5a07fb38433151  rkhunter-1.3.2/files/rkhunter.spec
-897aecb909610d8c2b967fffba4f9626416789fb  rkhunter-1.3.2/files/README
-d824c9ca8b591d108bd7b194350166ac65e64212  rkhunter-1.3.2/files/readlink.sh
-c82074175e72642dd74322ce29281f0f2fe2798c  rkhunter-1.3.2/files/programs_bad.dat
-d5bff919ce44a345a193824ea16b0404008d7823  rkhunter-1.3.2/files/programs_good.dat
-59de768a09a4cd13599653df85ecc2362e416ab3  rkhunter-1.3.2/files/defaulthashes.dat
-43bca835d9c64ab2f8cf7f1a5a078bb1b7da9306  rkhunter-1.3.2/files/showfiles.pl
-286d1c1fcfa924d63583ae961382250724ac9599  rkhunter-1.3.2/files/FAQ
-a0badd192cc4f33fbf38f446eae3c858ba81c88f  rkhunter-1.3.2/files/check_modules.pl
-285155f63cfa7a6a73ec0352dccaaa2221989b94  rkhunter-1.3.2/files/contrib/rkhunter_remote_howto.txt
-beed9c4b594c5be28ca4837fdcd2ac367e2946ee  rkhunter-1.3.2/files/contrib/run_rkhunter.sh
-225cc53f9691ad39f10bd2aaac478355ce4dc411  rkhunter-1.3.2/files/contrib/README.txt
-1b37e37eb80b4d7fd97b3d4e7f3711d3c4a335f4  rkhunter-1.3.2/installer.sh
diff --git a/rkhunter-1.3.4.tar.gz.sha1.txt b/rkhunter-1.3.4.tar.gz.sha1.txt
new file mode 100644
index 0000000..eb14540
--- /dev/null
+++ b/rkhunter-1.3.4.tar.gz.sha1.txt
@@ -0,0 +1,48 @@
+73a42c94be2fb1fd3284d8dc60d22ff0fc8407f4  rkhunter-1.3.4/files/WISHLIST
+c82074175e72642dd74322ce29281f0f2fe2798c  rkhunter-1.3.4/files/programs_bad.dat
+443431d6c4dde5ff474fc9521561c6858478ad81  rkhunter-1.3.4/files/rkhunter
+59de768a09a4cd13599653df85ecc2362e416ab3  rkhunter-1.3.4/files/defaulthashes.dat
+9203f315cf8ea90724f70595c0b8facd61169b4a  rkhunter-1.3.4/files/i18n/cn
+736fd9ea453f34c023a9ebed97fa0cea7461aeb8  rkhunter-1.3.4/files/i18n/zh.utf8
+3aa3999bd924382f2a7b7e52ad0c3f7834d2285c  rkhunter-1.3.4/files/i18n/zh
+a81ea7ee1677bb2f09c68ef55cac4819d102dfc0  rkhunter-1.3.4/files/i18n/en
+ff10891d252f3859abe63054eb64f0e9eae2d781  rkhunter-1.3.4/files/tools/README
+90876286c511986474144a5a1fc21afa0f5f29c5  rkhunter-1.3.4/files/tools/update_client.sh
+e3ba269e33d5d385230d0a4457d87cf6e3acece8  rkhunter-1.3.4/files/tools/update_server.sh
+98e225b334e319edaff76c079a3a241289ffa9c7  rkhunter-1.3.4/files/README
+ebc05604eb51b10478d35ac3750699cefecd5ae3  rkhunter-1.3.4/files/filehashmd5.pl
+d5bff919ce44a345a193824ea16b0404008d7823  rkhunter-1.3.4/files/programs_good.dat
+beed9c4b594c5be28ca4837fdcd2ac367e2946ee  rkhunter-1.3.4/files/contrib/run_rkhunter.sh
+225cc53f9691ad39f10bd2aaac478355ce4dc411  rkhunter-1.3.4/files/contrib/README.txt
+285155f63cfa7a6a73ec0352dccaaa2221989b94  rkhunter-1.3.4/files/contrib/rkhunter_remote_howto.txt
+56bf42d4fe669412b84eb307d5e314af4501dc9a  rkhunter-1.3.4/files/testing/stringscanner.sh
+361ada5406c7e57e62e840caf3d3bce5e8436fc1  rkhunter-1.3.4/files/testing/rootkitinfo.txt
+73e76916a3f65dde2317fff6c932e1d77760fdf7  rkhunter-1.3.4/files/testing/rkhunter.conf
+1878119b6045eeab6a5afaebad7b523e86c3a935  rkhunter-1.3.4/files/filehashsha1.pl
+a656a91b37a83a2325843f0ccedb5eb7866506ac  rkhunter-1.3.4/files/mirrors.dat
+9ddeec64999f4c0e6f9aa5992cd25c503311b764  rkhunter-1.3.4/files/backdoorports.dat
+a0badd192cc4f33fbf38f446eae3c858ba81c88f  rkhunter-1.3.4/files/check_modules.pl
+82c8c3881d59d228de3ce74a4b7b68eac07940f1  rkhunter-1.3.4/files/md5blacklist.dat
+4510d2228e144f80d75caef01c172095b2b4c24b  rkhunter-1.3.4/files/rkhunter.conf
+5c4319fe3f9acc552b7a9e973b7d081f7cb31642  rkhunter-1.3.4/files/check_port.pl
+f50ab02e29a0f4eba0ebe698f2c750a3b0298009  rkhunter-1.3.4/files/CHANGELOG
+951b498f71fc4a126ca435f7bce96ed8b821efb6  rkhunter-1.3.4/files/os.dat
+996a29dee608374e601ecf0253e445e16506c672  rkhunter-1.3.4/files/check_update.sh
+2e971f1c9f355d2172db3c5a33601b7037853ac1  rkhunter-1.3.4/files/FAQ
+7fa41ed0dc8c95b48b04dab42f1eaf8031c6ce7c  rkhunter-1.3.4/files/ACKNOWLEDGMENTS
+5dfa5246dc1c87b05f44f9f444466ce3d0d6edec  rkhunter-1.3.4/files/stat.pl
+345ab306455525cf5626caadda22b5dcbf732bc1  rkhunter-1.3.4/files/LICENSE
+5fc098260380362a515d32376e8d5522f1ccf716  rkhunter-1.3.4/files/readlink.sh
+e158163bfe6cb414d839e91880af37611f8b5cc0  rkhunter-1.3.4/files/development/createfilehashes.pl
+0c613880f3447af695ca9f9f93e158b34c2a10c3  rkhunter-1.3.4/files/development/osinformation.sh
+7378fb7e91b1f7e789508e4e8d00e1e3a70ee6ff  rkhunter-1.3.4/files/development/search_dead_sysmlinks.sh
+d09ab61a3563122b8cd6415e3083dfe1ef285a2b  rkhunter-1.3.4/files/development/i18nchk
+cb4903c649ad50b79230f5a5250da82c1d9ccb0f  rkhunter-1.3.4/files/development/createhashes.sh
+4f4dfb87e758236cadc5ac5af67bbb35f4f63eb1  rkhunter-1.3.4/files/development/rpmprelinkhashes.sh
+6b2f032d6143ed3b6ba3eae19d7921e154e69e47  rkhunter-1.3.4/files/development/createhashesall.sh
+614a5d3999055a8faeecc393c5695d628e5a7675  rkhunter-1.3.4/files/development/rpmhashes.sh
+ec4d60774decbb354f7aafcc2b65b1f87e000c97  rkhunter-1.3.4/files/suspscan.dat
+0b0c2b2b1e6342ada9b1df48cda550e5120f0cdf  rkhunter-1.3.4/files/rkhunter.8
+43bca835d9c64ab2f8cf7f1a5a078bb1b7da9306  rkhunter-1.3.4/files/showfiles.pl
+21d8c152e81061d37d122e3a82283448cd267e73  rkhunter-1.3.4/files/rkhunter.spec
+0093470e31268c538ecacc803969819faf742dde  rkhunter-1.3.4/installer.sh

From e7f1d992b97ef355a9791585ee82bc30c48ae4e0 Mon Sep 17 00:00:00 2001
From: Jesse Keating <jkeating@fedoraproject.org>
Date: Wed, 25 Feb 2009 20:02:58 +0000
Subject: [PATCH 023/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index fe651a7..0b8ff31 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.4
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -136,6 +136,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
+
 * Fri Jan 02 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-1
 - Update to 1.3.4
 - Use libdir as tmp dir - bug #456340

From 2f01ce0a138632a28844e705e99e2bb1c60fdb4e Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Thu, 5 Mar 2009 22:55:31 +0000
Subject: [PATCH 024/122] Rework spec file Add check for the new hmac ssh files
 Update cron job to     include hostname (thanks Manuel Wolfshant)

---
 01-rkhunter                       |   2 +-
 rkhunter-1.3.4-fedoraconfig.patch | 150 ++++++++++++++++++++++++++++++
 rkhunter.spec                     |  45 ++-------
 3 files changed, 161 insertions(+), 36 deletions(-)
 create mode 100644 rkhunter-1.3.4-fedoraconfig.patch

diff --git a/01-rkhunter b/01-rkhunter
index 0d0cce9..7ee97f5 100755
--- a/01-rkhunter
+++ b/01-rkhunter
@@ -42,7 +42,7 @@ if [ ! -e /var/lock/subsys/rkhunter ]; then
       >> $TMPFILE1
 
     if [ $XITVAL != 0 ]; then
-         /bin/cat $TMPFILE1 | /bin/mail -s 'rkhunter Daily Run' $MAILTO
+         /bin/cat $TMPFILE1 | /bin/mail -s "rkhunter Daily Run on $(hostname)" $MAILTO
     fi
     /bin/cat $TMPFILE1 >> $LOGFILE
   fi
diff --git a/rkhunter-1.3.4-fedoraconfig.patch b/rkhunter-1.3.4-fedoraconfig.patch
new file mode 100644
index 0000000..b17fa7a
--- /dev/null
+++ b/rkhunter-1.3.4-fedoraconfig.patch
@@ -0,0 +1,150 @@
+diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.conf
+--- rkhunter-1.3.4.orig/files/rkhunter.conf	2008-12-30 14:23:00.000000000 -0700
++++ rkhunter-1.3.4/files/rkhunter.conf	2009-03-04 22:09:48.000000000 -0700
+@@ -68,7 +68,7 @@
+ # NOTE: This option should be present in the configuration file.
+ #
+ #MAIL-ON-WARNING=me@mydomain   root@mydomain
+-MAIL-ON-WARNING=""
++MAIL-ON-WARNING="root@localhost"
+ 
+ #
+ # Specify the mail command to use if MAIL-ON-WARNING is set.
+@@ -84,17 +84,17 @@
+ # important files will be written to this directory, so be
+ # sure that the directory permissions are tight.
+ #
+-#TMPDIR=/var/lib/rkhunter/tmp
++TMPDIR=/var/lib/rkhunter/
+ 
+ #
+ # Specify the database directory to use.
+ #
+-#DBDIR=/var/lib/rkhunter/db
++DBDIR=/var/lib/rkhunter/db
+ 
+ #
+ # Specify the script directory to use.
+ #
+-#SCRIPTDIR=/usr/local/lib/rkhunter/scripts
++SCRIPTDIR=/usr/share/rkhunter/scripts
+ 
+ #
+ # Specify the root directory to use.
+@@ -123,13 +123,13 @@
+ #
+ # NOTE: This option should be present in the configuration file.
+ #
+-LOGFILE=/var/log/rkhunter.log
++LOGFILE=/var/log/rkhunter/rkhunter.log
+ 
+ #
+ # Set the following option to 1 if the log file is to be appended to
+ # whenever rkhunter is run.
+ #
+-APPEND_LOG=0
++APPEND_LOG=1
+ 
+ #
+ # Set the following option to enable the rkhunter check start and finish
+@@ -165,7 +165,7 @@
+ # file, then a value here of 'yes' or 'unset' will not cause a warning.
+ # This option has a default value of 'no'.
+ #
+-ALLOW_SSH_ROOT_USER=no
++ALLOW_SSH_ROOT_USER=yes
+ 
+ #
+ # Set this option to '1' to allow the use of the SSH-1 protocol, but note
+@@ -205,7 +205,7 @@
+ # tests, the test names, and how rkhunter behaves when these options are used.
+ #
+ ENABLE_TESTS="all"
+-DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps"
++DISABLE_TESTS="additional_rkts suspscan hidden_procs deleted_files packet_cap_apps"
+ 
+ #
+ # The HASH_FUNC option can be used to specify the command to use
+@@ -260,7 +260,7 @@
+ # For any file not part of a package, rkhunter will revert to using
+ # the HASH_FUNC hash function instead.
+ #
+-#PKGMGR=NONE
++PKGMGR=RPM
+ 
+ #
+ # Whitelist the hash (content) for the specified files.  Only useful
+@@ -298,6 +298,12 @@
+ #SCRIPTWHITELIST=/sbin/ifup
+ #SCRIPTWHITELIST=/sbin/ifdown
+ #SCRIPTWHITELIST=/usr/bin/groups
++SCRIPTWHITELIST=/usr/bin/whatis
++SCRIPTWHITELIST=/usr/bin/ldd
++SCRIPTWHITELIST=/usr/bin/groups
++SCRIPTWHITELIST=/usr/bin/GET
++SCRIPTWHITELIST=/sbin/ifup
++SCRIPTWHITELIST=/sbin/ifdown
+ 
+ #
+ # Allow the specified commands to have the immutable attribute set.
+@@ -310,7 +316,7 @@
+ # One directory per line (use multiple ALLOWHIDDENDIR lines).
+ #
+ #ALLOWHIDDENDIR=/etc/.java
+-#ALLOWHIDDENDIR=/dev/.udev
++ALLOWHIDDENDIR=/dev/.udev
+ #ALLOWHIDDENDIR=/dev/.udevdb
+ #ALLOWHIDDENDIR=/dev/.udev.tdb
+ #ALLOWHIDDENDIR=/dev/.static
+@@ -322,9 +328,18 @@
+ # One file per line (use multiple ALLOWHIDDENFILE lines).
+ # 
+ #ALLOWHIDDENFILE=/etc/.java
+-#ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
++ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
+ #ALLOWHIDDENFILE=/etc/.pwd.lock
+ #ALLOWHIDDENFILE=/etc/.init.state
++#
++# Allow hmac ssh files for Fedora
++#
++ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-keyscan.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-keygen.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-add.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-agent.hmac
++ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
+ 
+ #
+ # Allow the specified processes to use deleted files.
+@@ -367,7 +382,7 @@
+ # ALLOWDEVFILE lines).
+ #
+ #ALLOWDEVFILE=/dev/abc
+-#ALLOWDEVFILE=/dev/shm/pulse-shm-*
++ALLOWDEVFILE=/dev/shm/pulse-shm-*
+ 
+ #
+ # This setting tells rkhunter where the inetd configuration
+@@ -460,7 +475,7 @@
+ # file. This setting will be worked out by rkhunter, and so should not
+ # usually need to be set.
+ #
+-#SYSLOG_CONFIG_FILE=/etc/syslog.conf
++SYSLOG_CONFIG_FILE=/etc/rsyslog.conf
+ 
+ #
+ # This option permits the use of syslog remote logging.
+@@ -549,7 +564,7 @@
+ # specified, then RKH will assume the O/S release information is on the
+ # first non-blank line of the file.
+ #
+-#OS_VERSION_FILE="/etc/release"
++OS_VERSION_FILE="/etc/redhat-release"
+ 
+ #
+ # The following two options can be used to whitelist files and directories
+@@ -578,3 +593,4 @@
+ #
+ #MODULES_DIR=""
+ 
++INSTALLDIR="/usr"
diff --git a/rkhunter.spec b/rkhunter.spec
index 0b8ff31..ed9ccc0 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.4
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -10,6 +10,7 @@ Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.ta
 Source1:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz.sha1.txt
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
+Patch0:         rkhunter-1.3.4-fedoraconfig.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -26,40 +27,7 @@ and other unwanted tools.
 
 %setup -q
 
-%{__perl} -pi.0001 -e '
-	s|^#(MAIL-ON-WARNING=).+$|$1root\@localhost|;
-	s|^#(TMPDIR=).+$|$1%{_var}/lib/%{name}|;
-	s|^#(DBDIR=).+$|$1%{_var}/lib/%{name}/db|;
-	s|^#(SCRIPTDIR=).+$|$1%{_datadir}/%{name}/scripts|;
-	s|^#(PKGMGR=).+$|$1RPM|;
-%if 0%{?el4}%{?el5}
-	s|^#(OS_VERSION_FILE=).+$|$1/etc/redhat-release|;
-%else
-	s|^#(OS_VERSION_FILE=).+$|$1/etc/fedora-release|;
-%endif
-	s|^#(ALLOWHIDDENDIR=).+$|$1/dev/.udev|;
-	s|^#(ALLOWHIDDENFILE=).+$|$1/usr/share/man/man1/..1.gz|;
-	s|^(APPEND_LOG=).+$|$11|;
-	s|^(LOGFILE=).+$|$1/var/log/rkhunter/rkhunter.log|;
-	s|^(ALLOW_SSH_ROOT_USER=).+$|$1yes|;
-	s|^(DISABLE_TESTS=).+$|$1"additional_rkts suspscan hidden_procs deleted_files packet_cap_apps"|;
-    ' files/%{name}.conf
-
-# Add Fedora specific configs
-echo "INSTALLDIR=%{_prefix}" >> files/%{name}.conf
-echo "SCRIPTWHITELIST=/usr/bin/whatis" >> files/%name.conf
-echo "SCRIPTWHITELIST=/usr/bin/ldd" >> files/%name.conf
-echo "SCRIPTWHITELIST=/usr/bin/groups" >> files/%name.conf
-echo "SCRIPTWHITELIST=/usr/bin/GET" >> files/%name.conf
-echo "SCRIPTWHITELIST=/sbin/ifup" >> files/%name.conf
-echo "SCRIPTWHITELIST=/sbin/ifdown" >> files/%name.conf
-# in f8/f9/f10
-%if 0%{?fc8}%{?fc9}%{?fc10}
-echo "SYSLOG_CONFIG_FILE=/etc/rsyslog.conf" >> files/%name.conf
-echo "ALLOWDEVFILE=/dev/shm/pulse-shm-*" >> files/%name.conf
-%else
-echo "SYSLOG_CONFIG_FILE=/etc/syslog.conf" >> files/%name.conf
-%endif
+%patch0 -p1
 
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}/%{name}.log {
@@ -136,6 +104,13 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Mar 04 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-4
+- Rework spec file
+- Add check for the new hmac ssh files 
+
+* Thu Feb 26 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-3
+- Update cron job to include hostname (thanks  Manuel Wolfshant)
+
 * Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.4-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
 

From a52b4b65293f255c74e7277cc41f72ee061f08ee Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Thu, 5 Mar 2009 23:01:05 +0000
Subject: [PATCH 025/122] use proper release

---
 rkhunter.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index ed9ccc0..327ed65 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.4
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System

From 4ce1ab529bedb02ed11e680a233f4c51db158d39 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Sun, 8 Mar 2009 20:15:35 +0000
Subject: [PATCH 026/122] Fix typo in patch file

---
 rkhunter-1.3.4-fedoraconfig.patch | 2 +-
 rkhunter.spec                     | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/rkhunter-1.3.4-fedoraconfig.patch b/rkhunter-1.3.4-fedoraconfig.patch
index b17fa7a..b598dcb 100644
--- a/rkhunter-1.3.4-fedoraconfig.patch
+++ b/rkhunter-1.3.4-fedoraconfig.patch
@@ -139,7 +139,7 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  # first non-blank line of the file.
  #
 -#OS_VERSION_FILE="/etc/release"
-+OS_VERSION_FILE="/etc/redhat-release"
++OS_VERSION_FILE="/etc/fedora-release"
  
  #
  # The following two options can be used to whitelist files and directories
diff --git a/rkhunter.spec b/rkhunter.spec
index 327ed65..a26a0f4 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.4
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -104,6 +104,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Mar 08 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-5
+- Fix typo in patch file
+
 * Wed Mar 04 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-4
 - Rework spec file
 - Add check for the new hmac ssh files 

From c585ecc877710573a71da4d7200aab2ecab7c46c Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Sun, 7 Jun 2009 03:32:02 +0000
Subject: [PATCH 027/122] Add /usr/bin/.fipscheck.hmac to ok files - bug
 #494096

---
 rkhunter-1.3.4-fedoraconfig.patch | 13 +++++++------
 rkhunter.spec                     |  5 ++++-
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/rkhunter-1.3.4-fedoraconfig.patch b/rkhunter-1.3.4-fedoraconfig.patch
index b598dcb..6809531 100644
--- a/rkhunter-1.3.4-fedoraconfig.patch
+++ b/rkhunter-1.3.4-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.conf
 --- rkhunter-1.3.4.orig/files/rkhunter.conf	2008-12-30 14:23:00.000000000 -0700
-+++ rkhunter-1.3.4/files/rkhunter.conf	2009-03-04 22:09:48.000000000 -0700
++++ rkhunter-1.3.4/files/rkhunter.conf	2009-06-06 21:24:21.000000000 -0600
 @@ -68,7 +68,7 @@
  # NOTE: This option should be present in the configuration file.
  #
@@ -96,7 +96,7 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  #ALLOWHIDDENDIR=/dev/.udevdb
  #ALLOWHIDDENDIR=/dev/.udev.tdb
  #ALLOWHIDDENDIR=/dev/.static
-@@ -322,9 +328,18 @@
+@@ -322,9 +328,19 @@
  # One file per line (use multiple ALLOWHIDDENFILE lines).
  # 
  #ALLOWHIDDENFILE=/etc/.java
@@ -113,10 +113,11 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
 +ALLOWHIDDENFILE=/usr/bin/.ssh-add.hmac
 +ALLOWHIDDENFILE=/usr/bin/.ssh-agent.hmac
 +ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
++ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
  
  #
  # Allow the specified processes to use deleted files.
-@@ -367,7 +382,7 @@
+@@ -367,7 +383,7 @@
  # ALLOWDEVFILE lines).
  #
  #ALLOWDEVFILE=/dev/abc
@@ -125,7 +126,7 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  
  #
  # This setting tells rkhunter where the inetd configuration
-@@ -460,7 +475,7 @@
+@@ -460,7 +476,7 @@
  # file. This setting will be worked out by rkhunter, and so should not
  # usually need to be set.
  #
@@ -134,7 +135,7 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  
  #
  # This option permits the use of syslog remote logging.
-@@ -549,7 +564,7 @@
+@@ -549,7 +565,7 @@
  # specified, then RKH will assume the O/S release information is on the
  # first non-blank line of the file.
  #
@@ -143,7 +144,7 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  
  #
  # The following two options can be used to whitelist files and directories
-@@ -578,3 +593,4 @@
+@@ -578,3 +594,4 @@
  #
  #MODULES_DIR=""
  
diff --git a/rkhunter.spec b/rkhunter.spec
index a26a0f4..610349f 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.4
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -104,6 +104,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Jun 06 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-6
+- Add /usr/bin/.fipscheck.hmac to ok files - bug #494096
+
 * Sun Mar 08 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-5
 - Fix typo in patch file
 

From e7eb9e0cfa829a88012fd308ca9441a1176fe15c Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Fri, 3 Jul 2009 23:22:07 +0000
Subject: [PATCH 028/122] Add exception for software raid udev file - bug
 #509253

---
 rkhunter-1.3.4-fedoraconfig.patch | 14 ++++++++------
 rkhunter.spec                     |  5 ++++-
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/rkhunter-1.3.4-fedoraconfig.patch b/rkhunter-1.3.4-fedoraconfig.patch
index 6809531..40a66a3 100644
--- a/rkhunter-1.3.4-fedoraconfig.patch
+++ b/rkhunter-1.3.4-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.conf
 --- rkhunter-1.3.4.orig/files/rkhunter.conf	2008-12-30 14:23:00.000000000 -0700
-+++ rkhunter-1.3.4/files/rkhunter.conf	2009-06-06 21:24:21.000000000 -0600
++++ rkhunter-1.3.4/files/rkhunter.conf	2009-07-03 17:17:11.000000000 -0600
 @@ -68,7 +68,7 @@
  # NOTE: This option should be present in the configuration file.
  #
@@ -96,7 +96,7 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  #ALLOWHIDDENDIR=/dev/.udevdb
  #ALLOWHIDDENDIR=/dev/.udev.tdb
  #ALLOWHIDDENDIR=/dev/.static
-@@ -322,9 +328,19 @@
+@@ -322,9 +328,21 @@
  # One file per line (use multiple ALLOWHIDDENFILE lines).
  # 
  #ALLOWHIDDENFILE=/etc/.java
@@ -114,10 +114,12 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
 +ALLOWHIDDENFILE=/usr/bin/.ssh-agent.hmac
 +ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
 +ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
++# raid map
++ALLOWHIDDENFILE=/dev/.mdadm.map
  
  #
  # Allow the specified processes to use deleted files.
-@@ -367,7 +383,7 @@
+@@ -367,7 +385,7 @@
  # ALLOWDEVFILE lines).
  #
  #ALLOWDEVFILE=/dev/abc
@@ -126,7 +128,7 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  
  #
  # This setting tells rkhunter where the inetd configuration
-@@ -460,7 +476,7 @@
+@@ -460,7 +478,7 @@
  # file. This setting will be worked out by rkhunter, and so should not
  # usually need to be set.
  #
@@ -135,7 +137,7 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  
  #
  # This option permits the use of syslog remote logging.
-@@ -549,7 +565,7 @@
+@@ -549,7 +567,7 @@
  # specified, then RKH will assume the O/S release information is on the
  # first non-blank line of the file.
  #
@@ -144,7 +146,7 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  
  #
  # The following two options can be used to whitelist files and directories
-@@ -578,3 +594,4 @@
+@@ -578,3 +596,4 @@
  #
  #MODULES_DIR=""
  
diff --git a/rkhunter.spec b/rkhunter.spec
index 610349f..d7f01fd 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.4
-Release:        6%{?dist}
+Release:        7%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -104,6 +104,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jul 03 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-7
+- Add exception for software raid udev file - bug #509253
+
 * Sat Jun 06 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-6
 - Add /usr/bin/.fipscheck.hmac to ok files - bug #494096
 

From 22df91cd51112cd4a22fbb7f4e5dd47b566ec7b4 Mon Sep 17 00:00:00 2001
From: Jesse Keating <jkeating@fedoraproject.org>
Date: Mon, 27 Jul 2009 03:03:56 +0000
Subject: [PATCH 029/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index d7f01fd..547208b 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.4
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -104,6 +104,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.4-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
 * Fri Jul 03 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-7
 - Add exception for software raid udev file - bug #509253
 

From 965294994f8239d0982765ccc168530d61d1bc1d Mon Sep 17 00:00:00 2001
From: Bill Nottingham <notting@fedoraproject.org>
Date: Wed, 25 Nov 2009 23:13:19 +0000
Subject: [PATCH 030/122] Fix typo that causes a failure to update the common
 directory. (releng     #2781)

---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 6a822c7..9d0768c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,10 +1,10 @@
 # Makefile for source rpm: rkhunter
-# $Id$
+# $Id: Makefile,v 1.4 2008/02/15 04:30:23 kevin Exp $
 NAME := rkhunter
 SPECFILE = $(firstword $(wildcard *.spec))
 
 define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
+for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
 endef
 
 MAKEFILE_COMMON := $(shell $(find-makefile-common))

From 19ceddd22633520ecc83a13db939ea70088442d4 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Fri, 27 Nov 2009 05:16:08 +0000
Subject: [PATCH 031/122] Add exception for /dev/.mdadm file - bug #539405

---
 rkhunter-1.3.4-fedoraconfig.patch | 19 ++++++++++++-------
 rkhunter.spec                     |  5 ++++-
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/rkhunter-1.3.4-fedoraconfig.patch b/rkhunter-1.3.4-fedoraconfig.patch
index 40a66a3..be436ca 100644
--- a/rkhunter-1.3.4-fedoraconfig.patch
+++ b/rkhunter-1.3.4-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.conf
 --- rkhunter-1.3.4.orig/files/rkhunter.conf	2008-12-30 14:23:00.000000000 -0700
-+++ rkhunter-1.3.4/files/rkhunter.conf	2009-07-03 17:17:11.000000000 -0600
++++ rkhunter-1.3.4/files/rkhunter.conf	2009-11-26 21:45:14.000000000 -0700
 @@ -68,7 +68,7 @@
  # NOTE: This option should be present in the configuration file.
  #
@@ -87,7 +87,7 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  
  #
  # Allow the specified commands to have the immutable attribute set.
-@@ -310,7 +316,7 @@
+@@ -310,21 +316,34 @@
  # One directory per line (use multiple ALLOWHIDDENDIR lines).
  #
  #ALLOWHIDDENDIR=/etc/.java
@@ -96,7 +96,12 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  #ALLOWHIDDENDIR=/dev/.udevdb
  #ALLOWHIDDENDIR=/dev/.udev.tdb
  #ALLOWHIDDENDIR=/dev/.static
-@@ -322,9 +328,21 @@
+ #ALLOWHIDDENDIR=/dev/.initramfs
+ #ALLOWHIDDENDIR=/dev/.SRC-unix
++ALLOWHIDDENDIR=/dev/.mdadm
+ 
+ #
+ # Allow the specified hidden files.
  # One file per line (use multiple ALLOWHIDDENFILE lines).
  # 
  #ALLOWHIDDENFILE=/etc/.java
@@ -119,7 +124,7 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  
  #
  # Allow the specified processes to use deleted files.
-@@ -367,7 +385,7 @@
+@@ -367,7 +386,7 @@
  # ALLOWDEVFILE lines).
  #
  #ALLOWDEVFILE=/dev/abc
@@ -128,7 +133,7 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  
  #
  # This setting tells rkhunter where the inetd configuration
-@@ -460,7 +478,7 @@
+@@ -460,7 +479,7 @@
  # file. This setting will be worked out by rkhunter, and so should not
  # usually need to be set.
  #
@@ -137,7 +142,7 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  
  #
  # This option permits the use of syslog remote logging.
-@@ -549,7 +567,7 @@
+@@ -549,7 +568,7 @@
  # specified, then RKH will assume the O/S release information is on the
  # first non-blank line of the file.
  #
@@ -146,7 +151,7 @@ diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.
  
  #
  # The following two options can be used to whitelist files and directories
-@@ -578,3 +596,4 @@
+@@ -578,3 +597,4 @@
  #
  #MODULES_DIR=""
  
diff --git a/rkhunter.spec b/rkhunter.spec
index 547208b..ba1c18a 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.4
-Release:        8%{?dist}
+Release:        9%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -104,6 +104,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Thu Nov 26 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-9
+- Add exception for /dev/.mdadm file - bug #539405
+
 * Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.4-8
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
 

From 8ed422f7c99d5746b45fef9aad1ea3fb0d506409 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Mon, 30 Nov 2009 05:28:17 +0000
Subject: [PATCH 032/122] Update to 1.3.6

---
 .cvsignore                        |   2 +-
 rkhunter-1.3.4-fedoraconfig.patch | 158 ---------------------------
 rkhunter-1.3.6-fedoraconfig.patch | 176 ++++++++++++++++++++++++++++++
 rkhunter.spec                     |  18 +--
 sources                           |   2 +-
 5 files changed, 184 insertions(+), 172 deletions(-)
 delete mode 100644 rkhunter-1.3.4-fedoraconfig.patch
 create mode 100644 rkhunter-1.3.6-fedoraconfig.patch

diff --git a/.cvsignore b/.cvsignore
index 3c9d62b..d62cce3 100644
--- a/.cvsignore
+++ b/.cvsignore
@@ -1 +1 @@
-rkhunter-1.3.4.tar.gz
+rkhunter-1.3.6.tar.gz
diff --git a/rkhunter-1.3.4-fedoraconfig.patch b/rkhunter-1.3.4-fedoraconfig.patch
deleted file mode 100644
index be436ca..0000000
--- a/rkhunter-1.3.4-fedoraconfig.patch
+++ /dev/null
@@ -1,158 +0,0 @@
-diff -Nur rkhunter-1.3.4.orig/files/rkhunter.conf rkhunter-1.3.4/files/rkhunter.conf
---- rkhunter-1.3.4.orig/files/rkhunter.conf	2008-12-30 14:23:00.000000000 -0700
-+++ rkhunter-1.3.4/files/rkhunter.conf	2009-11-26 21:45:14.000000000 -0700
-@@ -68,7 +68,7 @@
- # NOTE: This option should be present in the configuration file.
- #
- #MAIL-ON-WARNING=me@mydomain   root@mydomain
--MAIL-ON-WARNING=""
-+MAIL-ON-WARNING="root@localhost"
- 
- #
- # Specify the mail command to use if MAIL-ON-WARNING is set.
-@@ -84,17 +84,17 @@
- # important files will be written to this directory, so be
- # sure that the directory permissions are tight.
- #
--#TMPDIR=/var/lib/rkhunter/tmp
-+TMPDIR=/var/lib/rkhunter/
- 
- #
- # Specify the database directory to use.
- #
--#DBDIR=/var/lib/rkhunter/db
-+DBDIR=/var/lib/rkhunter/db
- 
- #
- # Specify the script directory to use.
- #
--#SCRIPTDIR=/usr/local/lib/rkhunter/scripts
-+SCRIPTDIR=/usr/share/rkhunter/scripts
- 
- #
- # Specify the root directory to use.
-@@ -123,13 +123,13 @@
- #
- # NOTE: This option should be present in the configuration file.
- #
--LOGFILE=/var/log/rkhunter.log
-+LOGFILE=/var/log/rkhunter/rkhunter.log
- 
- #
- # Set the following option to 1 if the log file is to be appended to
- # whenever rkhunter is run.
- #
--APPEND_LOG=0
-+APPEND_LOG=1
- 
- #
- # Set the following option to enable the rkhunter check start and finish
-@@ -165,7 +165,7 @@
- # file, then a value here of 'yes' or 'unset' will not cause a warning.
- # This option has a default value of 'no'.
- #
--ALLOW_SSH_ROOT_USER=no
-+ALLOW_SSH_ROOT_USER=yes
- 
- #
- # Set this option to '1' to allow the use of the SSH-1 protocol, but note
-@@ -205,7 +205,7 @@
- # tests, the test names, and how rkhunter behaves when these options are used.
- #
- ENABLE_TESTS="all"
--DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps"
-+DISABLE_TESTS="additional_rkts suspscan hidden_procs deleted_files packet_cap_apps"
- 
- #
- # The HASH_FUNC option can be used to specify the command to use
-@@ -260,7 +260,7 @@
- # For any file not part of a package, rkhunter will revert to using
- # the HASH_FUNC hash function instead.
- #
--#PKGMGR=NONE
-+PKGMGR=RPM
- 
- #
- # Whitelist the hash (content) for the specified files.  Only useful
-@@ -298,6 +298,12 @@
- #SCRIPTWHITELIST=/sbin/ifup
- #SCRIPTWHITELIST=/sbin/ifdown
- #SCRIPTWHITELIST=/usr/bin/groups
-+SCRIPTWHITELIST=/usr/bin/whatis
-+SCRIPTWHITELIST=/usr/bin/ldd
-+SCRIPTWHITELIST=/usr/bin/groups
-+SCRIPTWHITELIST=/usr/bin/GET
-+SCRIPTWHITELIST=/sbin/ifup
-+SCRIPTWHITELIST=/sbin/ifdown
- 
- #
- # Allow the specified commands to have the immutable attribute set.
-@@ -310,21 +316,34 @@
- # One directory per line (use multiple ALLOWHIDDENDIR lines).
- #
- #ALLOWHIDDENDIR=/etc/.java
--#ALLOWHIDDENDIR=/dev/.udev
-+ALLOWHIDDENDIR=/dev/.udev
- #ALLOWHIDDENDIR=/dev/.udevdb
- #ALLOWHIDDENDIR=/dev/.udev.tdb
- #ALLOWHIDDENDIR=/dev/.static
- #ALLOWHIDDENDIR=/dev/.initramfs
- #ALLOWHIDDENDIR=/dev/.SRC-unix
-+ALLOWHIDDENDIR=/dev/.mdadm
- 
- #
- # Allow the specified hidden files.
- # One file per line (use multiple ALLOWHIDDENFILE lines).
- # 
- #ALLOWHIDDENFILE=/etc/.java
--#ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
-+ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
- #ALLOWHIDDENFILE=/etc/.pwd.lock
- #ALLOWHIDDENFILE=/etc/.init.state
-+#
-+# Allow hmac ssh files for Fedora
-+#
-+ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
-+ALLOWHIDDENFILE=/usr/bin/.ssh-keyscan.hmac
-+ALLOWHIDDENFILE=/usr/bin/.ssh-keygen.hmac
-+ALLOWHIDDENFILE=/usr/bin/.ssh-add.hmac
-+ALLOWHIDDENFILE=/usr/bin/.ssh-agent.hmac
-+ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
-+ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
-+# raid map
-+ALLOWHIDDENFILE=/dev/.mdadm.map
- 
- #
- # Allow the specified processes to use deleted files.
-@@ -367,7 +386,7 @@
- # ALLOWDEVFILE lines).
- #
- #ALLOWDEVFILE=/dev/abc
--#ALLOWDEVFILE=/dev/shm/pulse-shm-*
-+ALLOWDEVFILE=/dev/shm/pulse-shm-*
- 
- #
- # This setting tells rkhunter where the inetd configuration
-@@ -460,7 +479,7 @@
- # file. This setting will be worked out by rkhunter, and so should not
- # usually need to be set.
- #
--#SYSLOG_CONFIG_FILE=/etc/syslog.conf
-+SYSLOG_CONFIG_FILE=/etc/rsyslog.conf
- 
- #
- # This option permits the use of syslog remote logging.
-@@ -549,7 +568,7 @@
- # specified, then RKH will assume the O/S release information is on the
- # first non-blank line of the file.
- #
--#OS_VERSION_FILE="/etc/release"
-+OS_VERSION_FILE="/etc/fedora-release"
- 
- #
- # The following two options can be used to whitelist files and directories
-@@ -578,3 +597,4 @@
- #
- #MODULES_DIR=""
- 
-+INSTALLDIR="/usr"
diff --git a/rkhunter-1.3.6-fedoraconfig.patch b/rkhunter-1.3.6-fedoraconfig.patch
new file mode 100644
index 0000000..d4e2245
--- /dev/null
+++ b/rkhunter-1.3.6-fedoraconfig.patch
@@ -0,0 +1,176 @@
+diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.conf
+--- rkhunter-1.3.6.orig/files/rkhunter.conf	2009-11-28 15:13:19.000000000 -0700
++++ rkhunter-1.3.6/files/rkhunter.conf	2009-11-29 22:03:48.000000000 -0700
+@@ -71,7 +71,7 @@
+ # NOTE: This option should be present in the configuration file.
+ #
+ #MAIL-ON-WARNING=me@mydomain   root@mydomain
+-MAIL-ON-WARNING=""
++MAIL-ON-WARNING="root@localhost"
+ 
+ #
+ # Specify the mail command to use if MAIL-ON-WARNING is set.
+@@ -87,17 +87,17 @@
+ # important files will be written to this directory, so be
+ # sure that the directory permissions are tight.
+ #
+-#TMPDIR=/var/lib/rkhunter/tmp
++TMPDIR=/var/lib/rkhunter
+ 
+ #
+ # Specify the database directory to use.
+ #
+-#DBDIR=/var/lib/rkhunter/db
++DBDIR=/var/lib/rkhunter/db
+ 
+ #
+ # Specify the script directory to use.
+ #
+-#SCRIPTDIR=/usr/local/lib/rkhunter/scripts
++SCRIPTDIR=/usr/share/rkhunter/scripts
+ 
+ #
+ # Specify the root directory to use.
+@@ -138,13 +138,13 @@
+ #
+ # NOTE: This option should be present in the configuration file.
+ #
+-LOGFILE=/var/log/rkhunter.log
++LOGFILE=/var/log/rkhunter/rkhunter.log
+ 
+ #
+ # Set the following option to 1 if the log file is to be appended to
+ # whenever rkhunter is run.
+ #
+-APPEND_LOG=0
++APPEND_LOG=1
+ 
+ #
+ # Set the following option to 1 if the log file is to be copied when
+@@ -166,7 +166,7 @@
+ # Setting the value to 'none', or just leaving the option commented out,
+ # disables the use of syslog.
+ #
+-#USE_SYSLOG=authpriv.notice
++USE_SYSLOG=authpriv.notice
+ 
+ #
+ # Set the following option to 1 if the second colour set is to be used.
+@@ -196,7 +196,7 @@
+ # file, then a value here of 'yes' or 'unset' will not cause a warning.
+ # This option has a default value of 'no'.
+ #
+-ALLOW_SSH_ROOT_USER=no
++ALLOW_SSH_ROOT_USER=yes
+ 
+ #
+ # Set this option to '1' to allow the use of the SSH-1 protocol, but note
+@@ -299,7 +299,7 @@
+ #
+ # Whenever this option is changed 'rkhunter --propupd' must be run.
+ #
+-#PKGMGR=NONE
++PKGMGR=RPM
+ 
+ #
+ # It is possible that a file which is part of a package may be modified
+@@ -392,9 +392,12 @@
+ # Allow the specified commands to be scripts.
+ # One command per line (use multiple SCRIPTWHITELIST lines).
+ #
+-#SCRIPTWHITELIST=/sbin/ifup
+-#SCRIPTWHITELIST=/sbin/ifdown
+-#SCRIPTWHITELIST=/usr/bin/groups
++SCRIPTWHITELIST=/usr/bin/whatis
++SCRIPTWHITELIST=/usr/bin/ldd
++SCRIPTWHITELIST=/usr/bin/groups
++SCRIPTWHITELIST=/usr/bin/GET
++SCRIPTWHITELIST=/sbin/ifup
++SCRIPTWHITELIST=/sbin/ifdown
+ 
+ #
+ # Allow the specified commands to have the immutable attribute set.
+@@ -406,37 +409,35 @@
+ # Allow the specified hidden directories.
+ # One directory per line (use multiple ALLOWHIDDENDIR lines).
+ #
+-#ALLOWHIDDENDIR=/etc/.java
+-#ALLOWHIDDENDIR=/dev/.udev
+-#ALLOWHIDDENDIR=/dev/.udevdb
+-#ALLOWHIDDENDIR=/dev/.udev.tdb
+-#ALLOWHIDDENDIR=/dev/.static
+-#ALLOWHIDDENDIR=/dev/.initramfs
+-#ALLOWHIDDENDIR=/dev/.SRC-unix
+-#ALLOWHIDDENDIR=/dev/.mdadm
++ALLOWHIDDENDIR=/dev/.udev
++ALLOWHIDDENDIR=/dev/.udevdb
++ALLOWHIDDENDIR=/dev/.udev.tdb
++ALLOWHIDDENDIR=/dev/.static
++ALLOWHIDDENDIR=/dev/.initramfs
++ALLOWHIDDENDIR=/dev/.SRC-unix
++ALLOWHIDDENDIR=/dev/.mdadm
+ 
+ #
+ # Allow the specified hidden files.
+ # One file per line (use multiple ALLOWHIDDENFILE lines).
+ # 
+-#ALLOWHIDDENFILE=/etc/.java
+-#ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
++ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
+ #ALLOWHIDDENFILE=/etc/.pwd.lock
+ #ALLOWHIDDENFILE=/etc/.init.state
+-#ALLOWHIDDENFILE=/lib/.libcrypto.so.0.9.8e.hmac
+-#ALLOWHIDDENFILE=/lib/.libcrypto.so.6.hmac
+-#ALLOWHIDDENFILE=/lib/.libssl.so.0.9.8e.hmac
+-#ALLOWHIDDENFILE=/lib/.libssl.so.6.hmac
+-#ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
+-#ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
+-#ALLOWHIDDENFILE=/usr/lib/.libfipscheck.so.1.1.0.hmac
+-#ALLOWHIDDENFILE=/usr/lib/.libfipscheck.so.1.hmac
+-#ALLOWHIDDENFILE=/usr/lib/.libgcrypt.so.11.hmac
+-#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
+-#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
+-#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha384hmac.hmac
+-#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha512hmac.hmac
+-#ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
++ALLOWHIDDENFILE=/lib/.libcrypto.so.0.9.8e.hmac
++ALLOWHIDDENFILE=/lib/.libcrypto.so.6.hmac
++ALLOWHIDDENFILE=/lib/.libssl.so.0.9.8e.hmac
++ALLOWHIDDENFILE=/lib/.libssl.so.6.hmac
++ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
++ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.1.1.0.hmac
++ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.1.hmac
++ALLOWHIDDENFILE=/usr/lib*/.libgcrypt.so.11.hmac
++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha1hmac.hmac
++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha256hmac.hmac
++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha384hmac.hmac
++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha512hmac.hmac
++ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
+ 
+ #
+ # Allow the specified processes to use deleted files.
+@@ -495,7 +496,7 @@
+ # ALLOWDEVFILE lines).
+ #
+ #ALLOWDEVFILE=/dev/abc
+-#ALLOWDEVFILE=/dev/shm/pulse-shm-*
++ALLOWDEVFILE=/dev/shm/pulse-shm-*
+ #ALLOWDEVFILE=/dev/shm/sem.ADBE_ReadPrefs_*
+ #ALLOWDEVFILE=/dev/shm/sem.ADBE_REL_*
+ #ALLOWDEVFILE=/dev/shm/sem.ADBE_WritePrefs_*
+@@ -536,7 +537,7 @@
+ # This setting tells rkhunter where the xinetd configuration
+ # file is located.
+ #
+-#XINETD_CONF_PATH=/etc/xinetd.conf
++XINETD_CONF_PATH=/etc/xinetd.conf
+ 
+ #
+ # Allow the following enabled xinetd services. Whilst it would be
+@@ -822,3 +823,5 @@
+ # Enabling this feature implies you have the knowledge to interprete results properly. 
+ #
+ #SCANROOTKITMODE=THOROUGH
++
++INSTALLDIR="/usr"
diff --git a/rkhunter.spec b/rkhunter.spec
index ba1c18a..911db07 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,16 +1,15 @@
 Name:           rkhunter
-Version:        1.3.4
-Release:        9%{?dist}
+Version:        1.3.6
+Release:        1%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
 License:        GPLv2+
 URL:            http://rkhunter.sourceforge.net/
 Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz
-Source1:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz.sha1.txt
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
-Patch0:         rkhunter-1.3.4-fedoraconfig.patch
+Patch0:         rkhunter-1.3.6-fedoraconfig.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -56,27 +55,19 @@ EOF
 %{__install} -m755 -p files/%{name}             ${RPM_BUILD_ROOT}%{_bindir}/
 
 %{__install} -m644 -p files/backdoorports.dat   ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
-%{__install} -m644 -p files/defaulthashes.dat   ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
-%{__install} -m644 -p files/md5blacklist.dat    ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
 %{__install} -m644 -p files/mirrors.dat         ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
-%{__install} -m644 -p files/os.dat              ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
 %{__install} -m644 -p files/programs_bad.dat    ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
-%{__install} -m644 -p files/programs_good.dat   ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
 %{__install} -m644 -p files/i18n/cn             ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n/
 %{__install} -m644 -p files/i18n/en             ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n/
 
 %{__install} -m644 -p files/CHANGELOG           ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
 %{__install} -m644 -p files/LICENSE             ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
 %{__install} -m644 -p files/README              ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
-%{__install} -m644 -p files/WISHLIST            ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
 %{__install} -m755 -p files/check_modules.pl    ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/
-%{__install} -m755 -p files/check_port.pl       ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/
-%{__install} -m755 -p files/check_update.sh     ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/
 %{__install} -m644 -p files/*.8                 ${RPM_BUILD_ROOT}%{_mandir}/man8/
 # Don't ship these unless we want to Require the perl modules
 #%{__install} -m750 -p files/filehashmd5.pl      ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
 #%{__install} -m750 -p files/filehashsha1.pl     ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
-%{__install} -m755 -p files/showfiles.pl        ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/
 %{__install} -m755 -p %{SOURCE2}                ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/%{name}
 %{__install} -m644 -p %{name}.logrotate         ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/%{name}
 %{__install} -m640 -p files/%{name}.conf        ${RPM_BUILD_ROOT}%{_sysconfdir}/
@@ -104,6 +95,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Nov 29 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.6-1
+- Update to 1.3.6
+
 * Thu Nov 26 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-9
 - Add exception for /dev/.mdadm file - bug #539405
 
diff --git a/sources b/sources
index 72d4d0e..43900b2 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-31eaacc4d01ad138d1a4283f105088e6  rkhunter-1.3.4.tar.gz
+41bd92b1ea0803401c4a45215c8293a2  rkhunter-1.3.6.tar.gz

From a487fd2ad587b157cf43b87f81f7755be0eb2038 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Wed, 2 Dec 2009 01:04:11 +0000
Subject: [PATCH 033/122] Disable apps check by default - bug #543065

---
 rkhunter-1.3.6-fedoraconfig.patch | 11 ++++++++++-
 rkhunter.spec                     |  5 ++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/rkhunter-1.3.6-fedoraconfig.patch b/rkhunter-1.3.6-fedoraconfig.patch
index d4e2245..5966bf0 100644
--- a/rkhunter-1.3.6-fedoraconfig.patch
+++ b/rkhunter-1.3.6-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.conf
 --- rkhunter-1.3.6.orig/files/rkhunter.conf	2009-11-28 15:13:19.000000000 -0700
-+++ rkhunter-1.3.6/files/rkhunter.conf	2009-11-29 22:03:48.000000000 -0700
++++ rkhunter-1.3.6/files/rkhunter.conf	2009-12-01 17:43:15.000000000 -0700
 @@ -71,7 +71,7 @@
  # NOTE: This option should be present in the configuration file.
  #
@@ -65,6 +65,15 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  
  #
  # Set this option to '1' to allow the use of the SSH-1 protocol, but note
+@@ -236,7 +236,7 @@
+ # tests, the test names, and how rkhunter behaves when these options are used.
+ #
+ ENABLE_TESTS="all"
+-DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps"
++DISABLE_TESTS="apps suspscan hidden_procs deleted_files packet_cap_apps"
+ 
+ #
+ # The HASH_FUNC option can be used to specify the command to use
 @@ -299,7 +299,7 @@
  #
  # Whenever this option is changed 'rkhunter --propupd' must be run.
diff --git a/rkhunter.spec b/rkhunter.spec
index 911db07..0b5c05e 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.6
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -95,6 +95,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Tue Dec 01 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.6-2
+- Disable apps check by default - bug #543065
+
 * Sun Nov 29 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.6-1
 - Update to 1.3.6
 

From 07ce602824f688734b0c8670bb13cb96b393876a Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Tue, 5 Jan 2010 18:32:39 +0000
Subject: [PATCH 034/122] Add some more ssh hmac files to whitelist - bug
 #552621 Re-add     /dev/.mdadm.map to whitelisted files - bug #539405

---
 rkhunter-1.3.6-fedoraconfig.patch | 15 ++++++++++-----
 rkhunter.spec                     |  6 +++++-
 2 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/rkhunter-1.3.6-fedoraconfig.patch b/rkhunter-1.3.6-fedoraconfig.patch
index 5966bf0..6159b7c 100644
--- a/rkhunter-1.3.6-fedoraconfig.patch
+++ b/rkhunter-1.3.6-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.conf
 --- rkhunter-1.3.6.orig/files/rkhunter.conf	2009-11-28 15:13:19.000000000 -0700
-+++ rkhunter-1.3.6/files/rkhunter.conf	2009-12-01 17:43:15.000000000 -0700
++++ rkhunter-1.3.6/files/rkhunter.conf	2010-01-05 11:24:39.000000000 -0700
 @@ -71,7 +71,7 @@
  # NOTE: This option should be present in the configuration file.
  #
@@ -99,7 +99,7 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  
  #
  # Allow the specified commands to have the immutable attribute set.
-@@ -406,37 +409,35 @@
+@@ -406,37 +409,40 @@
  # Allow the specified hidden directories.
  # One directory per line (use multiple ALLOWHIDDENDIR lines).
  #
@@ -148,6 +148,10 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
 +ALLOWHIDDENFILE=/lib/.libssl.so.6.hmac
 +ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
 +ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-keygen.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-keyscan.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-add.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-agent.hmac
 +ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.1.1.0.hmac
 +ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.1.hmac
 +ALLOWHIDDENFILE=/usr/lib*/.libgcrypt.so.11.hmac
@@ -156,10 +160,11 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
 +ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha384hmac.hmac
 +ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha512hmac.hmac
 +ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
++ALLOWHIDDENFILE=/dev/.mdadm.map
  
  #
  # Allow the specified processes to use deleted files.
-@@ -495,7 +496,7 @@
+@@ -495,7 +501,7 @@
  # ALLOWDEVFILE lines).
  #
  #ALLOWDEVFILE=/dev/abc
@@ -168,7 +173,7 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_ReadPrefs_*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_REL_*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_WritePrefs_*
-@@ -536,7 +537,7 @@
+@@ -536,7 +542,7 @@
  # This setting tells rkhunter where the xinetd configuration
  # file is located.
  #
@@ -177,7 +182,7 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  
  #
  # Allow the following enabled xinetd services. Whilst it would be
-@@ -822,3 +823,5 @@
+@@ -822,3 +828,5 @@
  # Enabling this feature implies you have the knowledge to interprete results properly. 
  #
  #SCANROOTKITMODE=THOROUGH
diff --git a/rkhunter.spec b/rkhunter.spec
index 0b5c05e..c8a9fa9 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.6
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -95,6 +95,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Tue Jan 05 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-3
+- Add some more ssh hmac files to whitelist - bug #552621
+- Re-add /dev/.mdadm.map to whitelisted files - bug #539405
+
 * Tue Dec 01 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.6-2
 - Disable apps check by default - bug #543065
 

From e9432edd9d3c4985235be408fd40cd6ba9d49aea Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Sun, 24 Jan 2010 01:31:31 +0000
Subject: [PATCH 035/122] Change email to just root instead of root@localhost -
 bug #553179 Add     .k5login.5.gz to files whitelist - bug #553134

---
 rkhunter-1.3.6-fedoraconfig.patch | 13 +++++++------
 rkhunter.spec                     |  6 +++++-
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/rkhunter-1.3.6-fedoraconfig.patch b/rkhunter-1.3.6-fedoraconfig.patch
index 6159b7c..2a0d712 100644
--- a/rkhunter-1.3.6-fedoraconfig.patch
+++ b/rkhunter-1.3.6-fedoraconfig.patch
@@ -1,12 +1,12 @@
 diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.conf
 --- rkhunter-1.3.6.orig/files/rkhunter.conf	2009-11-28 15:13:19.000000000 -0700
-+++ rkhunter-1.3.6/files/rkhunter.conf	2010-01-05 11:24:39.000000000 -0700
++++ rkhunter-1.3.6/files/rkhunter.conf	2010-01-23 18:03:32.000000000 -0700
 @@ -71,7 +71,7 @@
  # NOTE: This option should be present in the configuration file.
  #
  #MAIL-ON-WARNING=me@mydomain   root@mydomain
 -MAIL-ON-WARNING=""
-+MAIL-ON-WARNING="root@localhost"
++MAIL-ON-WARNING="root"
  
  #
  # Specify the mail command to use if MAIL-ON-WARNING is set.
@@ -99,7 +99,7 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  
  #
  # Allow the specified commands to have the immutable attribute set.
-@@ -406,37 +409,40 @@
+@@ -406,37 +409,41 @@
  # Allow the specified hidden directories.
  # One directory per line (use multiple ALLOWHIDDENDIR lines).
  #
@@ -161,10 +161,11 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
 +ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha512hmac.hmac
 +ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
 +ALLOWHIDDENFILE=/dev/.mdadm.map
++ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz
  
  #
  # Allow the specified processes to use deleted files.
-@@ -495,7 +501,7 @@
+@@ -495,7 +502,7 @@
  # ALLOWDEVFILE lines).
  #
  #ALLOWDEVFILE=/dev/abc
@@ -173,7 +174,7 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_ReadPrefs_*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_REL_*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_WritePrefs_*
-@@ -536,7 +542,7 @@
+@@ -536,7 +543,7 @@
  # This setting tells rkhunter where the xinetd configuration
  # file is located.
  #
@@ -182,7 +183,7 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  
  #
  # Allow the following enabled xinetd services. Whilst it would be
-@@ -822,3 +828,5 @@
+@@ -822,3 +829,5 @@
  # Enabling this feature implies you have the knowledge to interprete results properly. 
  #
  #SCANROOTKITMODE=THOROUGH
diff --git a/rkhunter.spec b/rkhunter.spec
index c8a9fa9..57282ac 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.6
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -95,6 +95,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Jan 23 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-4
+- Change email to just root instead of root@localhost - bug #553179
+- Add .k5login.5.gz to files whitelist - bug #553134
+
 * Tue Jan 05 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-3
 - Add some more ssh hmac files to whitelist - bug #552621
 - Re-add /dev/.mdadm.map to whitelisted files - bug #539405

From d0dab82f518859a8c146d9f37ab0984f66048e55 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Sat, 6 Mar 2010 22:09:05 +0000
Subject: [PATCH 036/122] Change config to not specify XINETD_PATH - bug
 #560562

---
 rkhunter-1.3.6-fedoraconfig.patch | 11 +----------
 rkhunter.spec                     |  5 ++++-
 2 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/rkhunter-1.3.6-fedoraconfig.patch b/rkhunter-1.3.6-fedoraconfig.patch
index 2a0d712..563aa41 100644
--- a/rkhunter-1.3.6-fedoraconfig.patch
+++ b/rkhunter-1.3.6-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.conf
 --- rkhunter-1.3.6.orig/files/rkhunter.conf	2009-11-28 15:13:19.000000000 -0700
-+++ rkhunter-1.3.6/files/rkhunter.conf	2010-01-23 18:03:32.000000000 -0700
++++ rkhunter-1.3.6/files/rkhunter.conf	2010-03-06 14:41:28.000000000 -0700
 @@ -71,7 +71,7 @@
  # NOTE: This option should be present in the configuration file.
  #
@@ -174,15 +174,6 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_ReadPrefs_*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_REL_*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_WritePrefs_*
-@@ -536,7 +543,7 @@
- # This setting tells rkhunter where the xinetd configuration
- # file is located.
- #
--#XINETD_CONF_PATH=/etc/xinetd.conf
-+XINETD_CONF_PATH=/etc/xinetd.conf
- 
- #
- # Allow the following enabled xinetd services. Whilst it would be
 @@ -822,3 +829,5 @@
  # Enabling this feature implies you have the knowledge to interprete results properly. 
  #
diff --git a/rkhunter.spec b/rkhunter.spec
index 57282ac..39d633c 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.6
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -95,6 +95,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Mar 06 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-5
+- Change config to not specify XINETD_PATH - bug #560562
+
 * Sat Jan 23 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-4
 - Change email to just root instead of root@localhost - bug #553179
 - Add .k5login.5.gz to files whitelist - bug #553134

From 50f2c95e4339c9373b393bf3b91f1f2572fcb746 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Fri, 28 May 2010 23:26:19 +0000
Subject: [PATCH 037/122] - Add exclude for md-device-map - bug #596731 -
 Supress ssh version check - bug #596775

---
 rkhunter-1.3.6-fedoraconfig.patch | 19 ++++++++++++++++---
 rkhunter.spec                     |  6 +++++-
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/rkhunter-1.3.6-fedoraconfig.patch b/rkhunter-1.3.6-fedoraconfig.patch
index 563aa41..7621655 100644
--- a/rkhunter-1.3.6-fedoraconfig.patch
+++ b/rkhunter-1.3.6-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.conf
 --- rkhunter-1.3.6.orig/files/rkhunter.conf	2009-11-28 15:13:19.000000000 -0700
-+++ rkhunter-1.3.6/files/rkhunter.conf	2010-03-06 14:41:28.000000000 -0700
++++ rkhunter-1.3.6/files/rkhunter.conf	2010-05-28 16:57:08.000000000 -0600
 @@ -71,7 +71,7 @@
  # NOTE: This option should be present in the configuration file.
  #
@@ -65,6 +65,15 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  
  #
  # Set this option to '1' to allow the use of the SSH-1 protocol, but note
+@@ -207,7 +207,7 @@
+ # configuration file, then a value of '2' may be set here in order to
+ # suppress a warning message. This option has a default value of '0'.
+ #
+-ALLOW_SSH_PROT_V1=0
++ALLOW_SSH_PROT_V1=2
+ 
+ #
+ # This setting tells rkhunter the directory containing the SSH configuration
 @@ -236,7 +236,7 @@
  # tests, the test names, and how rkhunter behaves when these options are used.
  #
@@ -165,7 +174,7 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  
  #
  # Allow the specified processes to use deleted files.
-@@ -495,7 +502,7 @@
+@@ -495,10 +502,11 @@
  # ALLOWDEVFILE lines).
  #
  #ALLOWDEVFILE=/dev/abc
@@ -174,7 +183,11 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_ReadPrefs_*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_REL_*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_WritePrefs_*
-@@ -822,3 +829,5 @@
++ALLOWDEVFILE=/dev/md/md-device-map
+ 
+ #
+ # This setting tells rkhunter where the inetd configuration
+@@ -822,3 +830,5 @@
  # Enabling this feature implies you have the knowledge to interprete results properly. 
  #
  #SCANROOTKITMODE=THOROUGH
diff --git a/rkhunter.spec b/rkhunter.spec
index 39d633c..0160450 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.6
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -95,6 +95,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri May 28 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-6
+- Add exclude for md-device-map - bug #596731
+- Supress ssh version check - bug #596775
+
 * Sat Mar 06 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-5
 - Change config to not specify XINETD_PATH - bug #560562
 

From c6abba777e9deacbb7d8c727495dbada28114b80 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@fedoraproject.org>
Date: Sat, 5 Jun 2010 18:20:53 +0000
Subject: [PATCH 038/122] Add ipsec.hmac exclude - bug #560594

---
 rkhunter-1.3.6-fedoraconfig.patch | 9 +++++----
 rkhunter.spec                     | 5 ++++-
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/rkhunter-1.3.6-fedoraconfig.patch b/rkhunter-1.3.6-fedoraconfig.patch
index 7621655..33531b6 100644
--- a/rkhunter-1.3.6-fedoraconfig.patch
+++ b/rkhunter-1.3.6-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.conf
 --- rkhunter-1.3.6.orig/files/rkhunter.conf	2009-11-28 15:13:19.000000000 -0700
-+++ rkhunter-1.3.6/files/rkhunter.conf	2010-05-28 16:57:08.000000000 -0600
++++ rkhunter-1.3.6/files/rkhunter.conf	2010-06-05 12:07:58.000000000 -0600
 @@ -71,7 +71,7 @@
  # NOTE: This option should be present in the configuration file.
  #
@@ -108,7 +108,7 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  
  #
  # Allow the specified commands to have the immutable attribute set.
-@@ -406,37 +409,41 @@
+@@ -406,37 +409,42 @@
  # Allow the specified hidden directories.
  # One directory per line (use multiple ALLOWHIDDENDIR lines).
  #
@@ -171,10 +171,11 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
 +ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
 +ALLOWHIDDENFILE=/dev/.mdadm.map
 +ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz
++ALLOWHIDDENFILE=/usr/sbin/.ipsec.hmac
  
  #
  # Allow the specified processes to use deleted files.
-@@ -495,10 +502,11 @@
+@@ -495,10 +503,11 @@
  # ALLOWDEVFILE lines).
  #
  #ALLOWDEVFILE=/dev/abc
@@ -187,7 +188,7 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  
  #
  # This setting tells rkhunter where the inetd configuration
-@@ -822,3 +830,5 @@
+@@ -822,3 +831,5 @@
  # Enabling this feature implies you have the knowledge to interprete results properly. 
  #
  #SCANROOTKITMODE=THOROUGH
diff --git a/rkhunter.spec b/rkhunter.spec
index 0160450..e070d7b 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.6
-Release:        6%{?dist}
+Release:        7%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -95,6 +95,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Jun 05 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-7
+- Add ipsec.hmac exclude - bug #560594
+
 * Fri May 28 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-6
 - Add exclude for md-device-map - bug #596731
 - Supress ssh version check - bug #596775

From b5daa470f057096c8da68cdb9568189c6a81482f Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <rel-eng@lists.fedoraproject.org>
Date: Thu, 29 Jul 2010 11:31:54 +0000
Subject: [PATCH 039/122] dist-git conversion

---
 .cvsignore => .gitignore |  0
 Makefile                 | 21 ---------------------
 2 files changed, 21 deletions(-)
 rename .cvsignore => .gitignore (100%)
 delete mode 100644 Makefile

diff --git a/.cvsignore b/.gitignore
similarity index 100%
rename from .cvsignore
rename to .gitignore
diff --git a/Makefile b/Makefile
deleted file mode 100644
index 9d0768c..0000000
--- a/Makefile
+++ /dev/null
@@ -1,21 +0,0 @@
-# Makefile for source rpm: rkhunter
-# $Id: Makefile,v 1.4 2008/02/15 04:30:23 kevin Exp $
-NAME := rkhunter
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON := $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)

From dc4e40a162d2d0532234f2128db2b62d0b69c53f Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@tummy.com>
Date: Wed, 24 Nov 2010 15:19:41 -0700
Subject: [PATCH 040/122] Drop /var/run as it's not used anymore - bug #656684
 Add patch to make rkhunter use unhide if installed - bug #636396

---
 rkhunter-1.3.6-unhide.patch | 29 +++++++++++++++++++++++++++++
 rkhunter.spec               | 12 +++++++++---
 2 files changed, 38 insertions(+), 3 deletions(-)
 create mode 100644 rkhunter-1.3.6-unhide.patch

diff --git a/rkhunter-1.3.6-unhide.patch b/rkhunter-1.3.6-unhide.patch
new file mode 100644
index 0000000..27c62e2
--- /dev/null
+++ b/rkhunter-1.3.6-unhide.patch
@@ -0,0 +1,29 @@
+diff -Nur rkhunter-1.3.6.orig/files/rkhunter rkhunter-1.3.6/files/rkhunter
+--- rkhunter-1.3.6.orig/files/rkhunter	2009-11-29 06:05:09.000000000 -0700
++++ rkhunter-1.3.6/files/rkhunter	2010-10-06 13:17:40.870265006 -0600
+@@ -9779,7 +9779,7 @@
+ 		RKHTMPVAR="unhide"
+ 		UNHIDE_CMD=`find_cmd unhide`
+ 
+-		if [ "${OPERATING_SYSTEM}" = "Linux" ]; then
++		if [  -z "${UNHIDE_CMD}" -a "${OPERATING_SYSTEM}" = "Linux" ]; then
+ 			if [ -n "`uname -r | grep '^2\.6'`" ]; then
+ 				RKHTMPVAR="unhide-linux26"
+ 				UNHIDE_CMD=`find_cmd unhide-linux26`
+@@ -13215,11 +13215,11 @@
+ 	fi
+ 
+ 	if [ "${OPERATING_SYSTEM}" = "Linux" ]; then
+-		if [ -n "`uname -r | grep '^2\.6'`" ]; then
+-			PROP_FILE_LIST="${PROP_FILE_LIST} unhide-linux26"
+-		else
+-			PROP_FILE_LIST="${PROP_FILE_LIST} unhide"
+-		fi
++		#if [ -n "`uname -r | grep '^2\.6'`" ]; then
++		#	PROP_FILE_LIST="${PROP_FILE_LIST} unhide-linux26"
++		#else
++		PROP_FILE_LIST="${PROP_FILE_LIST} unhide"
++		#fi
+         elif [ $SUNOS -eq 1 -o $BSDOS -eq 1 ]; then
+ 		PROP_FILE_LIST="${PROP_FILE_LIST} unhide"
+         fi
diff --git a/rkhunter.spec b/rkhunter.spec
index e070d7b..2a3123f 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.6
-Release:        7%{?dist}
+Release:        9%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -10,6 +10,7 @@ Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.ta
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
 Patch0:         rkhunter-1.3.6-fedoraconfig.patch
+Patch1:		rkhunter-1.3.6-unhide.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -27,6 +28,7 @@ and other unwanted tools.
 %setup -q
 
 %patch0 -p1
+%patch1 -p1
 
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}/%{name}.log {
@@ -48,7 +50,6 @@ EOF
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db
-%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/run/%{name}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/log/%{name}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n
 
@@ -87,7 +88,6 @@ EOF
 %dir %{_var}/lib/%{name}
 %{_var}/lib/%{name}/db
 %{_var}/lib/%{name}/db/i18n
-%dir %{_var}/run/%{name}
 %dir %{_var}/log/%{name}
 %config(noreplace) %{_sysconfdir}/%{name}.conf
 %config(noreplace) %{_sysconfdir}/sysconfig/%{name}
@@ -95,6 +95,12 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Nov 24 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-9
+- Drop /var/run as it's not used anymore - bug #656684
+
+* Wed Oct 06 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-8
+- Add patch to make rkhunter use unhide if installed - bug #636396
+
 * Sat Jun 05 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-7
 - Add ipsec.hmac exclude - bug #560594
 

From 4477f5af2f5e32bcaf6709a15edbff6f974f75b3 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@tummy.com>
Date: Fri, 26 Nov 2010 12:22:51 -0700
Subject: [PATCH 041/122] Update to 1.3.8

---
 .gitignore                                    |   1 +
 01-rkhunter                                   |   2 +-
 rkhunter-1.3.6-unhide.patch                   |  29 ----
 ...patch => rkhunter-1.3.8-fedoraconfig.patch | 132 +++++++-----------
 rkhunter.spec                                 |  11 +-
 sources                                       |   2 +-
 6 files changed, 63 insertions(+), 114 deletions(-)
 delete mode 100644 rkhunter-1.3.6-unhide.patch
 rename rkhunter-1.3.6-fedoraconfig.patch => rkhunter-1.3.8-fedoraconfig.patch (51%)

diff --git a/.gitignore b/.gitignore
index d62cce3..d8de726 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 rkhunter-1.3.6.tar.gz
+/rkhunter-1.3.8.tar.gz
diff --git a/01-rkhunter b/01-rkhunter
index 7ee97f5..6ff8877 100755
--- a/01-rkhunter
+++ b/01-rkhunter
@@ -4,7 +4,7 @@
 XITVAL=0
 
 # Get a secure tempfile
-TMPFILE1=`/bin/mktemp -p /var/run/rkhunter rkhcronlog.XXXXXXXXXX` || exit 1
+TMPFILE1=`/bin/mktemp -p /var/lib/rkhunter rkhcronlog.XXXXXXXXXX` || exit 1
 
 if [ ! -e /var/lock/subsys/rkhunter ]; then
 
diff --git a/rkhunter-1.3.6-unhide.patch b/rkhunter-1.3.6-unhide.patch
deleted file mode 100644
index 27c62e2..0000000
--- a/rkhunter-1.3.6-unhide.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-diff -Nur rkhunter-1.3.6.orig/files/rkhunter rkhunter-1.3.6/files/rkhunter
---- rkhunter-1.3.6.orig/files/rkhunter	2009-11-29 06:05:09.000000000 -0700
-+++ rkhunter-1.3.6/files/rkhunter	2010-10-06 13:17:40.870265006 -0600
-@@ -9779,7 +9779,7 @@
- 		RKHTMPVAR="unhide"
- 		UNHIDE_CMD=`find_cmd unhide`
- 
--		if [ "${OPERATING_SYSTEM}" = "Linux" ]; then
-+		if [  -z "${UNHIDE_CMD}" -a "${OPERATING_SYSTEM}" = "Linux" ]; then
- 			if [ -n "`uname -r | grep '^2\.6'`" ]; then
- 				RKHTMPVAR="unhide-linux26"
- 				UNHIDE_CMD=`find_cmd unhide-linux26`
-@@ -13215,11 +13215,11 @@
- 	fi
- 
- 	if [ "${OPERATING_SYSTEM}" = "Linux" ]; then
--		if [ -n "`uname -r | grep '^2\.6'`" ]; then
--			PROP_FILE_LIST="${PROP_FILE_LIST} unhide-linux26"
--		else
--			PROP_FILE_LIST="${PROP_FILE_LIST} unhide"
--		fi
-+		#if [ -n "`uname -r | grep '^2\.6'`" ]; then
-+		#	PROP_FILE_LIST="${PROP_FILE_LIST} unhide-linux26"
-+		#else
-+		PROP_FILE_LIST="${PROP_FILE_LIST} unhide"
-+		#fi
-         elif [ $SUNOS -eq 1 -o $BSDOS -eq 1 ]; then
- 		PROP_FILE_LIST="${PROP_FILE_LIST} unhide"
-         fi
diff --git a/rkhunter-1.3.6-fedoraconfig.patch b/rkhunter-1.3.8-fedoraconfig.patch
similarity index 51%
rename from rkhunter-1.3.6-fedoraconfig.patch
rename to rkhunter-1.3.8-fedoraconfig.patch
index 33531b6..9da0492 100644
--- a/rkhunter-1.3.6-fedoraconfig.patch
+++ b/rkhunter-1.3.8-fedoraconfig.patch
@@ -1,7 +1,7 @@
-diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.conf
---- rkhunter-1.3.6.orig/files/rkhunter.conf	2009-11-28 15:13:19.000000000 -0700
-+++ rkhunter-1.3.6/files/rkhunter.conf	2010-06-05 12:07:58.000000000 -0600
-@@ -71,7 +71,7 @@
+diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.conf
+--- rkhunter-1.3.8.orig/files/rkhunter.conf	2010-11-13 13:25:22.000000000 -0700
++++ rkhunter-1.3.8/files/rkhunter.conf	2010-11-26 10:52:58.580254755 -0700
+@@ -76,7 +76,7 @@
  # NOTE: This option should be present in the configuration file.
  #
  #MAIL-ON-WARNING=me@mydomain   root@mydomain
@@ -10,28 +10,27 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  
  #
  # Specify the mail command to use if MAIL-ON-WARNING is set.
-@@ -87,17 +87,17 @@
- # important files will be written to this directory, so be
+@@ -94,16 +94,19 @@
  # sure that the directory permissions are tight.
  #
--#TMPDIR=/var/lib/rkhunter/tmp
+ #TMPDIR=/var/lib/rkhunter/tmp
 +TMPDIR=/var/lib/rkhunter
  
  #
  # Specify the database directory to use.
  #
--#DBDIR=/var/lib/rkhunter/db
+ #DBDIR=/var/lib/rkhunter/db
 +DBDIR=/var/lib/rkhunter/db
  
  #
  # Specify the script directory to use.
  #
--#SCRIPTDIR=/usr/local/lib/rkhunter/scripts
+ #SCRIPTDIR=/usr/local/lib/rkhunter/scripts
 +SCRIPTDIR=/usr/share/rkhunter/scripts
  
  #
  # Specify the root directory to use.
-@@ -138,13 +138,13 @@
+@@ -155,13 +158,13 @@
  #
  # NOTE: This option should be present in the configuration file.
  #
@@ -47,7 +46,7 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  
  #
  # Set the following option to 1 if the log file is to be copied when
-@@ -166,7 +166,7 @@
+@@ -183,7 +186,7 @@
  # Setting the value to 'none', or just leaving the option commented out,
  # disables the use of syslog.
  #
@@ -56,8 +55,8 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  
  #
  # Set the following option to 1 if the second colour set is to be used.
-@@ -196,7 +196,7 @@
- # file, then a value here of 'yes' or 'unset' will not cause a warning.
+@@ -213,7 +216,7 @@
+ # file, then a value here of 'unset' can be used to avoid warning messages.
  # This option has a default value of 'no'.
  #
 -ALLOW_SSH_ROOT_USER=no
@@ -65,40 +64,36 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  
  #
  # Set this option to '1' to allow the use of the SSH-1 protocol, but note
-@@ -207,7 +207,7 @@
+@@ -224,7 +227,7 @@
  # configuration file, then a value of '2' may be set here in order to
  # suppress a warning message. This option has a default value of '0'.
  #
 -ALLOW_SSH_PROT_V1=0
-+ALLOW_SSH_PROT_V1=2
++ALLOW_SSH_PROT_V1=0
  
  #
  # This setting tells rkhunter the directory containing the SSH configuration
-@@ -236,7 +236,7 @@
+@@ -255,7 +258,7 @@
  # tests, the test names, and how rkhunter behaves when these options are used.
  #
  ENABLE_TESTS="all"
--DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps"
-+DISABLE_TESTS="apps suspscan hidden_procs deleted_files packet_cap_apps"
+-DISABLE_TESTS="suspscan hidden_ports hidden_procs deleted_files packet_cap_apps"
++DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps"
  
  #
  # The HASH_FUNC option can be used to specify the command to use
-@@ -299,7 +299,7 @@
- #
+@@ -324,6 +327,7 @@
  # Whenever this option is changed 'rkhunter --propupd' must be run.
  #
--#PKGMGR=NONE
+ #PKGMGR=NONE
 +PKGMGR=RPM
  
  #
  # It is possible that a file which is part of a package may be modified
-@@ -392,9 +392,12 @@
- # Allow the specified commands to be scripts.
- # One command per line (use multiple SCRIPTWHITELIST lines).
+@@ -466,6 +470,12 @@
  #
--#SCRIPTWHITELIST=/sbin/ifup
--#SCRIPTWHITELIST=/sbin/ifdown
--#SCRIPTWHITELIST=/usr/bin/groups
+ #SCRIPTWHITELIST="/sbin/ifup /sbin/ifdown"
+ #SCRIPTWHITELIST="/usr/bin/groups"
 +SCRIPTWHITELIST=/usr/bin/whatis
 +SCRIPTWHITELIST=/usr/bin/ldd
 +SCRIPTWHITELIST=/usr/bin/groups
@@ -108,18 +103,10 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
  
  #
  # Allow the specified commands to have the immutable attribute set.
-@@ -406,37 +409,42 @@
- # Allow the specified hidden directories.
- # One directory per line (use multiple ALLOWHIDDENDIR lines).
- #
--#ALLOWHIDDENDIR=/etc/.java
--#ALLOWHIDDENDIR=/dev/.udev
--#ALLOWHIDDENDIR=/dev/.udevdb
--#ALLOWHIDDENDIR=/dev/.udev.tdb
--#ALLOWHIDDENDIR=/dev/.static
--#ALLOWHIDDENDIR=/dev/.initramfs
--#ALLOWHIDDENDIR=/dev/.SRC-unix
--#ALLOWHIDDENDIR=/dev/.mdadm
+@@ -495,6 +505,14 @@
+ #ALLOWHIDDENDIR="/dev/.initramfs"
+ #ALLOWHIDDENDIR="/dev/.SRC-unix"
+ #ALLOWHIDDENDIR="/dev/.mdadm"
 +ALLOWHIDDENDIR=/dev/.udev
 +ALLOWHIDDENDIR=/dev/.udevdb
 +ALLOWHIDDENDIR=/dev/.udev.tdb
@@ -127,43 +114,28 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
 +ALLOWHIDDENDIR=/dev/.initramfs
 +ALLOWHIDDENDIR=/dev/.SRC-unix
 +ALLOWHIDDENDIR=/dev/.mdadm
++ALLOWHIDDENDIR=/dev/.systemd
  
  #
- # Allow the specified hidden files.
- # One file per line (use multiple ALLOWHIDDENFILE lines).
- # 
--#ALLOWHIDDENFILE=/etc/.java
--#ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
+ # Allow the specified hidden files to be whitelisted.
+@@ -519,6 +537,28 @@
+ #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha384hmac.hmac"
+ #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha512hmac.hmac"
+ #ALLOWHIDDENFILE="/usr/sbin/.sshd.hmac"
 +ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
- #ALLOWHIDDENFILE=/etc/.pwd.lock
- #ALLOWHIDDENFILE=/etc/.init.state
--#ALLOWHIDDENFILE=/lib/.libcrypto.so.0.9.8e.hmac
--#ALLOWHIDDENFILE=/lib/.libcrypto.so.6.hmac
--#ALLOWHIDDENFILE=/lib/.libssl.so.0.9.8e.hmac
--#ALLOWHIDDENFILE=/lib/.libssl.so.6.hmac
--#ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
--#ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
--#ALLOWHIDDENFILE=/usr/lib/.libfipscheck.so.1.1.0.hmac
--#ALLOWHIDDENFILE=/usr/lib/.libfipscheck.so.1.hmac
--#ALLOWHIDDENFILE=/usr/lib/.libgcrypt.so.11.hmac
--#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
--#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
--#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha384hmac.hmac
--#ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha512hmac.hmac
--#ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
-+ALLOWHIDDENFILE=/lib/.libcrypto.so.0.9.8e.hmac
-+ALLOWHIDDENFILE=/lib/.libcrypto.so.6.hmac
-+ALLOWHIDDENFILE=/lib/.libssl.so.0.9.8e.hmac
-+ALLOWHIDDENFILE=/lib/.libssl.so.6.hmac
++ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac
++ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac
++ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac
++ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac
 +ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
 +ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
 +ALLOWHIDDENFILE=/usr/bin/.ssh-keygen.hmac
 +ALLOWHIDDENFILE=/usr/bin/.ssh-keyscan.hmac
 +ALLOWHIDDENFILE=/usr/bin/.ssh-add.hmac
 +ALLOWHIDDENFILE=/usr/bin/.ssh-agent.hmac
-+ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.1.1.0.hmac
-+ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.1.hmac
-+ALLOWHIDDENFILE=/usr/lib*/.libgcrypt.so.11.hmac
++ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.*.hmac
++ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.*.hmac
++ALLOWHIDDENFILE=/usr/lib*/.libgcrypt.so.*.hmac
 +ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha1hmac.hmac
 +ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha256hmac.hmac
 +ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha384hmac.hmac
@@ -174,23 +146,27 @@ diff -Nur rkhunter-1.3.6.orig/files/rkhunter.conf rkhunter-1.3.6/files/rkhunter.
 +ALLOWHIDDENFILE=/usr/sbin/.ipsec.hmac
  
  #
- # Allow the specified processes to use deleted files.
-@@ -495,10 +503,11 @@
- # ALLOWDEVFILE lines).
+ # Allow the specified processes to use deleted files. The
+@@ -583,6 +623,8 @@
  #
- #ALLOWDEVFILE=/dev/abc
--#ALLOWDEVFILE=/dev/shm/pulse-shm-*
+ #ALLOWDEVFILE="/dev/shm/pulse-shm-*"
+ #ALLOWDEVFILE="/dev/shm/sem.ADBE_*"
 +ALLOWDEVFILE=/dev/shm/pulse-shm-*
- #ALLOWDEVFILE=/dev/shm/sem.ADBE_ReadPrefs_*
- #ALLOWDEVFILE=/dev/shm/sem.ADBE_REL_*
- #ALLOWDEVFILE=/dev/shm/sem.ADBE_WritePrefs_*
 +ALLOWDEVFILE=/dev/md/md-device-map
  
  #
  # This setting tells rkhunter where the inetd configuration
-@@ -822,3 +831,5 @@
- # Enabling this feature implies you have the knowledge to interprete results properly. 
+@@ -721,6 +763,7 @@
+ # The option may be specified more than once.
  #
- #SCANROOTKITMODE=THOROUGH
+ #SUSPSCAN_DIRS="/tmp /var/tmp"
++SUSPSCAN_DIRS="/tmp /var/tmp"
+ 
+ #
+ # Directory for temporary files. A memory-based one is better (faster).
+@@ -976,3 +1019,5 @@
+ # both programs, then disable the 'hidden_procs' test.
+ #
+ #DISABLE_UNHIDE=0
 +
 +INSTALLDIR="/usr"
diff --git a/rkhunter.spec b/rkhunter.spec
index 2a3123f..6b8ca61 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
-Version:        1.3.6
-Release:        9%{?dist}
+Version:        1.3.8
+Release:        1%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -9,8 +9,7 @@ URL:            http://rkhunter.sourceforge.net/
 Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
-Patch0:         rkhunter-1.3.6-fedoraconfig.patch
-Patch1:		rkhunter-1.3.6-unhide.patch
+Patch0:         rkhunter-1.3.8-fedoraconfig.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -28,7 +27,6 @@ and other unwanted tools.
 %setup -q
 
 %patch0 -p1
-%patch1 -p1
 
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}/%{name}.log {
@@ -95,6 +93,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Nov 26 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.8-1
+- Update to 1.3.8
+
 * Wed Nov 24 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-9
 - Drop /var/run as it's not used anymore - bug #656684
 
diff --git a/sources b/sources
index 43900b2..4445e10 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-41bd92b1ea0803401c4a45215c8293a2  rkhunter-1.3.6.tar.gz
+0c34eb2a2d0caa384f442c11fcbb0c46  rkhunter-1.3.8.tar.gz

From c319b49fc09613a7c9feb388ea1c5dbf76a3eccd Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@tummy.com>
Date: Wed, 8 Dec 2010 21:04:42 -0700
Subject: [PATCH 042/122] Adjust config some - bug #596775

---
 rkhunter-1.3.8-fedoraconfig.patch | 17 +++++++----------
 rkhunter.spec                     |  5 ++++-
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/rkhunter-1.3.8-fedoraconfig.patch b/rkhunter-1.3.8-fedoraconfig.patch
index 9da0492..d9f410f 100644
--- a/rkhunter-1.3.8-fedoraconfig.patch
+++ b/rkhunter-1.3.8-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.conf
 --- rkhunter-1.3.8.orig/files/rkhunter.conf	2010-11-13 13:25:22.000000000 -0700
-+++ rkhunter-1.3.8/files/rkhunter.conf	2010-11-26 10:52:58.580254755 -0700
++++ rkhunter-1.3.8/files/rkhunter.conf	2010-12-07 18:49:08.194871526 -0700
 @@ -76,7 +76,7 @@
  # NOTE: This option should be present in the configuration file.
  #
@@ -60,7 +60,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  # This option has a default value of 'no'.
  #
 -ALLOW_SSH_ROOT_USER=no
-+ALLOW_SSH_ROOT_USER=yes
++ALLOW_SSH_ROOT_USER=unset
  
  #
  # Set this option to '1' to allow the use of the SSH-1 protocol, but note
@@ -78,7 +78,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  #
  ENABLE_TESTS="all"
 -DISABLE_TESTS="suspscan hidden_ports hidden_procs deleted_files packet_cap_apps"
-+DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps"
++DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps apps"
  
  #
  # The HASH_FUNC option can be used to specify the command to use
@@ -118,14 +118,12 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Allow the specified hidden files to be whitelisted.
-@@ -519,6 +537,28 @@
+@@ -519,6 +537,25 @@
  #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha384hmac.hmac"
  #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha512hmac.hmac"
  #ALLOWHIDDENFILE="/usr/sbin/.sshd.hmac"
 +ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
 +ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac
-+ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac
-+ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac
 +ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac
 +ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
 +ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
@@ -134,7 +132,6 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
 +ALLOWHIDDENFILE=/usr/bin/.ssh-add.hmac
 +ALLOWHIDDENFILE=/usr/bin/.ssh-agent.hmac
 +ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.*.hmac
-+ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.*.hmac
 +ALLOWHIDDENFILE=/usr/lib*/.libgcrypt.so.*.hmac
 +ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha1hmac.hmac
 +ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha256hmac.hmac
@@ -147,7 +144,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Allow the specified processes to use deleted files. The
-@@ -583,6 +623,8 @@
+@@ -583,6 +620,8 @@
  #
  #ALLOWDEVFILE="/dev/shm/pulse-shm-*"
  #ALLOWDEVFILE="/dev/shm/sem.ADBE_*"
@@ -156,7 +153,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # This setting tells rkhunter where the inetd configuration
-@@ -721,6 +763,7 @@
+@@ -721,6 +760,7 @@
  # The option may be specified more than once.
  #
  #SUSPSCAN_DIRS="/tmp /var/tmp"
@@ -164,7 +161,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Directory for temporary files. A memory-based one is better (faster).
-@@ -976,3 +1019,5 @@
+@@ -976,3 +1016,5 @@
  # both programs, then disable the 'hidden_procs' test.
  #
  #DISABLE_UNHIDE=0
diff --git a/rkhunter.spec b/rkhunter.spec
index 6b8ca61..bc9f5d8 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.8
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -93,6 +93,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Tue Dec 07 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.8-2
+- Adjust config some - bug #596775
+
 * Fri Nov 26 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.8-1
 - Update to 1.3.8
 

From 742df90da04f1531e69d05e404254b84d7aa99ef Mon Sep 17 00:00:00 2001
From: Dennis Gilmore <dennis@ausil.us>
Date: Wed, 9 Feb 2011 02:00:01 -0600
Subject: [PATCH 043/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index bc9f5d8..38a033b 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.8
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -93,6 +93,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.8-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+
 * Tue Dec 07 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.8-2
 - Adjust config some - bug #596775
 

From 7419ff45b49237ff0a740505082b979a970aea9b Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@tummy.com>
Date: Wed, 13 Apr 2011 20:07:48 -0600
Subject: [PATCH 044/122] Don't send warning emails anymore. They cause selinux
 issues and are not very helpful. Fixes bug #660544

---
 rkhunter-1.3.8-fedoraconfig.patch | 20 +-------------------
 rkhunter.spec                     |  6 +++++-
 2 files changed, 6 insertions(+), 20 deletions(-)

diff --git a/rkhunter-1.3.8-fedoraconfig.patch b/rkhunter-1.3.8-fedoraconfig.patch
index d9f410f..a7728f8 100644
--- a/rkhunter-1.3.8-fedoraconfig.patch
+++ b/rkhunter-1.3.8-fedoraconfig.patch
@@ -1,15 +1,6 @@
 diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.conf
 --- rkhunter-1.3.8.orig/files/rkhunter.conf	2010-11-13 13:25:22.000000000 -0700
-+++ rkhunter-1.3.8/files/rkhunter.conf	2010-12-07 18:49:08.194871526 -0700
-@@ -76,7 +76,7 @@
- # NOTE: This option should be present in the configuration file.
- #
- #MAIL-ON-WARNING=me@mydomain   root@mydomain
--MAIL-ON-WARNING=""
-+MAIL-ON-WARNING="root"
- 
- #
- # Specify the mail command to use if MAIL-ON-WARNING is set.
++++ rkhunter-1.3.8/files/rkhunter.conf	2011-04-13 13:58:11.190895105 -0600
 @@ -94,16 +94,19 @@
  # sure that the directory permissions are tight.
  #
@@ -64,15 +55,6 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Set this option to '1' to allow the use of the SSH-1 protocol, but note
-@@ -224,7 +227,7 @@
- # configuration file, then a value of '2' may be set here in order to
- # suppress a warning message. This option has a default value of '0'.
- #
--ALLOW_SSH_PROT_V1=0
-+ALLOW_SSH_PROT_V1=0
- 
- #
- # This setting tells rkhunter the directory containing the SSH configuration
 @@ -255,7 +258,7 @@
  # tests, the test names, and how rkhunter behaves when these options are used.
  #
diff --git a/rkhunter.spec b/rkhunter.spec
index 38a033b..c901375 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.8
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -93,6 +93,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Apr 13 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-4
+- Don't send warning emails anymore. They cause selinux issues and are not very helpful.
+- Fixes bug #660544
+
 * Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.8-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
 

From 2a753b3b8d26c639985fd2918b34f7888125a08c Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@tummy.com>
Date: Thu, 21 Apr 2011 15:49:36 -0600
Subject: [PATCH 045/122] Add /dev/.mount to ALLOW_HIDDENDIR - bug #697599

---
 rkhunter-1.3.8-fedoraconfig.patch | 13 +++++++------
 rkhunter.spec                     |  5 ++++-
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/rkhunter-1.3.8-fedoraconfig.patch b/rkhunter-1.3.8-fedoraconfig.patch
index a7728f8..059db09 100644
--- a/rkhunter-1.3.8-fedoraconfig.patch
+++ b/rkhunter-1.3.8-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.conf
 --- rkhunter-1.3.8.orig/files/rkhunter.conf	2010-11-13 13:25:22.000000000 -0700
-+++ rkhunter-1.3.8/files/rkhunter.conf	2011-04-13 13:58:11.190895105 -0600
++++ rkhunter-1.3.8/files/rkhunter.conf	2011-04-21 15:45:15.705280977 -0600
 @@ -94,16 +94,19 @@
  # sure that the directory permissions are tight.
  #
@@ -85,7 +85,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Allow the specified commands to have the immutable attribute set.
-@@ -495,6 +505,14 @@
+@@ -495,6 +505,15 @@
  #ALLOWHIDDENDIR="/dev/.initramfs"
  #ALLOWHIDDENDIR="/dev/.SRC-unix"
  #ALLOWHIDDENDIR="/dev/.mdadm"
@@ -97,10 +97,11 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
 +ALLOWHIDDENDIR=/dev/.SRC-unix
 +ALLOWHIDDENDIR=/dev/.mdadm
 +ALLOWHIDDENDIR=/dev/.systemd
++ALLOWHIDDENDIR=/dev/.mount
  
  #
  # Allow the specified hidden files to be whitelisted.
-@@ -519,6 +537,25 @@
+@@ -519,6 +538,25 @@
  #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha384hmac.hmac"
  #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha512hmac.hmac"
  #ALLOWHIDDENFILE="/usr/sbin/.sshd.hmac"
@@ -126,7 +127,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Allow the specified processes to use deleted files. The
-@@ -583,6 +620,8 @@
+@@ -583,6 +621,8 @@
  #
  #ALLOWDEVFILE="/dev/shm/pulse-shm-*"
  #ALLOWDEVFILE="/dev/shm/sem.ADBE_*"
@@ -135,7 +136,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # This setting tells rkhunter where the inetd configuration
-@@ -721,6 +760,7 @@
+@@ -721,6 +761,7 @@
  # The option may be specified more than once.
  #
  #SUSPSCAN_DIRS="/tmp /var/tmp"
@@ -143,7 +144,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Directory for temporary files. A memory-based one is better (faster).
-@@ -976,3 +1016,5 @@
+@@ -976,3 +1017,5 @@
  # both programs, then disable the 'hidden_procs' test.
  #
  #DISABLE_UNHIDE=0
diff --git a/rkhunter.spec b/rkhunter.spec
index c901375..a50dc15 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.8
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -93,6 +93,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Thu Apr 21 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-5
+- Add /dev/.mount to ALLOW_HIDDENDIR - bug #697599
+
 * Wed Apr 13 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-4
 - Don't send warning emails anymore. They cause selinux issues and are not very helpful.
 - Fixes bug #660544

From 88040f3d5d8725522c7bfc4f8866142a33d0a14c Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Tue, 21 Jun 2011 15:45:04 -0600
Subject: [PATCH 046/122] Change ssh check back to 2 - bug #596775 Drop hard
 Requires on prelink. It will be used if present - bug #714067

---
 rkhunter-1.3.8-fedoraconfig.patch | 11 ++++++++++-
 rkhunter.spec                     |  8 ++++++--
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/rkhunter-1.3.8-fedoraconfig.patch b/rkhunter-1.3.8-fedoraconfig.patch
index 059db09..b264a0e 100644
--- a/rkhunter-1.3.8-fedoraconfig.patch
+++ b/rkhunter-1.3.8-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.conf
 --- rkhunter-1.3.8.orig/files/rkhunter.conf	2010-11-13 13:25:22.000000000 -0700
-+++ rkhunter-1.3.8/files/rkhunter.conf	2011-04-21 15:45:15.705280977 -0600
++++ rkhunter-1.3.8/files/rkhunter.conf	2011-06-21 15:38:05.689017234 -0600
 @@ -94,16 +94,19 @@
  # sure that the directory permissions are tight.
  #
@@ -55,6 +55,15 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Set this option to '1' to allow the use of the SSH-1 protocol, but note
+@@ -224,7 +227,7 @@
+ # configuration file, then a value of '2' may be set here in order to
+ # suppress a warning message. This option has a default value of '0'.
+ #
+-ALLOW_SSH_PROT_V1=0
++ALLOW_SSH_PROT_V1=2
+ 
+ #
+ # This setting tells rkhunter the directory containing the SSH configuration
 @@ -255,7 +258,7 @@
  # tests, the test names, and how rkhunter behaves when these options are used.
  #
diff --git a/rkhunter.spec b/rkhunter.spec
index a50dc15..7a18722 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.8
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -14,7 +14,7 @@ BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 Requires:       coreutils, binutils, modutils, findutils, grep, mktemp
-Requires:       e2fsprogs, procps, lsof, prelink, iproute, net-tools, wget
+Requires:       e2fsprogs, procps, lsof, iproute, net-tools, wget
 Requires:       perl, perl(strict), perl(IO::Socket), mailx, logrotate
 
 %description
@@ -93,6 +93,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Tue Jun 21 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-6
+- Change ssh check back to 2 - bug #596775
+- Drop hard Requires on prelink. It will be used if present - bug #714067
+
 * Thu Apr 21 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-5
 - Add /dev/.mount to ALLOW_HIDDENDIR - bug #697599
 

From 73581d58829b38dc062985ce1a8e8c5bc605b257 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Fri, 8 Jul 2011 09:37:06 -0600
Subject: [PATCH 047/122] Add patch to fix out of the box warning on rkhunter
 script. Fixes bug #719270 Add etckeeper and tomboy files. Fixes bug #719265
 and #719259

---
 rkhunter-1.3.8-fedoraconfig.patch | 23 +++++++++++++++++------
 rkhunter-1.3.8-file.patch         | 21 +++++++++++++++++++++
 rkhunter.spec                     | 10 +++++++++-
 3 files changed, 47 insertions(+), 7 deletions(-)
 create mode 100644 rkhunter-1.3.8-file.patch

diff --git a/rkhunter-1.3.8-fedoraconfig.patch b/rkhunter-1.3.8-fedoraconfig.patch
index b264a0e..aac7359 100644
--- a/rkhunter-1.3.8-fedoraconfig.patch
+++ b/rkhunter-1.3.8-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.conf
 --- rkhunter-1.3.8.orig/files/rkhunter.conf	2010-11-13 13:25:22.000000000 -0700
-+++ rkhunter-1.3.8/files/rkhunter.conf	2011-06-21 15:38:05.689017234 -0600
++++ rkhunter-1.3.8/files/rkhunter.conf	2011-07-08 09:01:31.660923511 -0600
 @@ -94,16 +94,19 @@
  # sure that the directory permissions are tight.
  #
@@ -94,7 +94,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Allow the specified commands to have the immutable attribute set.
-@@ -495,6 +505,15 @@
+@@ -495,6 +505,18 @@
  #ALLOWHIDDENDIR="/dev/.initramfs"
  #ALLOWHIDDENDIR="/dev/.SRC-unix"
  #ALLOWHIDDENDIR="/dev/.mdadm"
@@ -107,10 +107,13 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
 +ALLOWHIDDENDIR=/dev/.mdadm
 +ALLOWHIDDENDIR=/dev/.systemd
 +ALLOWHIDDENDIR=/dev/.mount
++# for etckeeper
++ALLOWHIDDENDIR=/etc/.git
++ALLOWHIDDENDIR=/etc/.bzr
  
  #
  # Allow the specified hidden files to be whitelisted.
-@@ -519,6 +538,25 @@
+@@ -519,6 +541,29 @@
  #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha384hmac.hmac"
  #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha512hmac.hmac"
  #ALLOWHIDDENFILE="/usr/sbin/.sshd.hmac"
@@ -133,19 +136,27 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
 +ALLOWHIDDENFILE=/dev/.mdadm.map
 +ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz
 +ALLOWHIDDENFILE=/usr/sbin/.ipsec.hmac
++# etckeeper
++ALLOWHIDDENFILE=/etc/.etckeeper
++ALLOWHIDDENFILE=/etc/.gitignore
++ALLOWHIDDENFILE=/etc/.bzrignore
  
  #
  # Allow the specified processes to use deleted files. The
-@@ -583,6 +621,8 @@
+@@ -583,6 +628,12 @@
  #
  #ALLOWDEVFILE="/dev/shm/pulse-shm-*"
  #ALLOWDEVFILE="/dev/shm/sem.ADBE_*"
 +ALLOWDEVFILE=/dev/shm/pulse-shm-*
 +ALLOWDEVFILE=/dev/md/md-device-map
++# tomboy creates this one
++ALLOWDEVFILE="/dev/shm/mono.*"
++# created by libv4l
++ALLOWDEVFILE="/dev/shm/libv4l-*
  
  #
  # This setting tells rkhunter where the inetd configuration
-@@ -721,6 +761,7 @@
+@@ -721,6 +772,7 @@
  # The option may be specified more than once.
  #
  #SUSPSCAN_DIRS="/tmp /var/tmp"
@@ -153,7 +164,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Directory for temporary files. A memory-based one is better (faster).
-@@ -976,3 +1017,5 @@
+@@ -976,3 +1028,5 @@
  # both programs, then disable the 'hidden_procs' test.
  #
  #DISABLE_UNHIDE=0
diff --git a/rkhunter-1.3.8-file.patch b/rkhunter-1.3.8-file.patch
new file mode 100644
index 0000000..3b35199
--- /dev/null
+++ b/rkhunter-1.3.8-file.patch
@@ -0,0 +1,21 @@
+diff -Nur rkhunter-1.3.8.orig/files/rkhunter rkhunter-1.3.8/files/rkhunter
+--- rkhunter-1.3.8.orig/files/rkhunter	2010-11-16 17:33:49.000000000 -0700
++++ rkhunter-1.3.8/files/rkhunter	2011-07-08 08:48:12.930204260 -0600
+@@ -9880,11 +9880,15 @@
+ 					test -n "${BASENAME_CMD}" && RKHTMPVAR=`${BASENAME_CMD} ${FNAME}` || RKHTMPVAR=`echo "${FNAME}" | sed -e 's:^.*/::'`
+ 
+ 					if [ "${RKHTMPVAR}" = "rkhunter" ]; then
+-						SYSSCRIPT=`${FILE_CMD} ${FNAME} 2>&1 | tr -s '	' ' ' | cat -v | egrep -i -v '(shell|/bin/sh) script( |$)'`
++                                               SYSSCRIPT=`${FILE_CMD} ${FNAME} 2>&1 | tr -s '  ' ' ' | cat -v | egrep -i -v '(shell|/bin/sh) script( |,|$)'`
+ 					else
+-						SYSSCRIPT=`${FILE_CMD} ${FNAME} 2>&1 | tr -s '	' ' ' | cat -v | egrep -i ' script( |$)'`
++                                               SYSSCRIPT=`${FILE_CMD} ${FNAME} 2>&1 | tr -s '  ' ' ' | cat -v | egrep -i ' script( |,|$)'`
+ 					fi
+ 
++
++                                        else
++
++
+ 					test -n "${SYSSCRIPT}" && TEST_RESULT="${TEST_RESULT} script"
+ 				fi
+ 			fi
diff --git a/rkhunter.spec b/rkhunter.spec
index 7a18722..4e7943d 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.8
-Release:        6%{?dist}
+Release:        7%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -10,6 +10,8 @@ Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.ta
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
 Patch0:         rkhunter-1.3.8-fedoraconfig.patch
+# Upstream in http://rkhunter.cvs.sourceforge.net/viewvc/rkhunter/rkhunter/files/rkhunter?r1=1.396&r2=1.397&view=patch
+Patch1:		rkhunter-1.3.8-file.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -27,6 +29,7 @@ and other unwanted tools.
 %setup -q
 
 %patch0 -p1
+%patch1 -p1
 
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}/%{name}.log {
@@ -93,6 +96,11 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jul 08 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-7
+- Add patch to fix out of the box warning on rkhunter script. 
+- Fixes bug #719270
+- Add etckeeper and tomboy files. Fixes bug #719265 and #719259
+
 * Tue Jun 21 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-6
 - Change ssh check back to 2 - bug #596775
 - Drop hard Requires on prelink. It will be used if present - bug #714067

From 096111c718d9afcf584572f95288b0489cc66a5e Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Fri, 8 Jul 2011 10:37:49 -0600
Subject: [PATCH 048/122] Fix typo

---
 rkhunter-1.3.8-fedoraconfig.patch | 2 +-
 rkhunter.spec                     | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/rkhunter-1.3.8-fedoraconfig.patch b/rkhunter-1.3.8-fedoraconfig.patch
index aac7359..9938e04 100644
--- a/rkhunter-1.3.8-fedoraconfig.patch
+++ b/rkhunter-1.3.8-fedoraconfig.patch
@@ -152,7 +152,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
 +# tomboy creates this one
 +ALLOWDEVFILE="/dev/shm/mono.*"
 +# created by libv4l
-+ALLOWDEVFILE="/dev/shm/libv4l-*
++ALLOWDEVFILE="/dev/shm/libv4l-*"
  
  #
  # This setting tells rkhunter where the inetd configuration
diff --git a/rkhunter.spec b/rkhunter.spec
index 4e7943d..99002fd 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.8
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -96,6 +96,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jul 08 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-8
+- Fix typo
+
 * Fri Jul 08 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-7
 - Add patch to fix out of the box warning on rkhunter script. 
 - Fixes bug #719270

From 3f82808f89535c43e7168324ad1df4b832589a54 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Fri, 5 Aug 2011 16:50:17 -0600
Subject: [PATCH 049/122] Add patch to fix ALLOWPROCDELFILE config option.
 fixes bug #727524

---
 rkhunter-1.3.8-ifs.patch | 21 +++++++++++++++++++++
 rkhunter.spec            |  8 +++++++-
 2 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 rkhunter-1.3.8-ifs.patch

diff --git a/rkhunter-1.3.8-ifs.patch b/rkhunter-1.3.8-ifs.patch
new file mode 100644
index 0000000..8c7f476
--- /dev/null
+++ b/rkhunter-1.3.8-ifs.patch
@@ -0,0 +1,21 @@
+diff -Nur rkhunter-1.3.8.orig/files/rkhunter rkhunter-1.3.8/files/rkhunter
+--- rkhunter-1.3.8.orig/files/rkhunter	2011-08-05 16:44:41.771726323 -0600
++++ rkhunter-1.3.8/files/rkhunter	2011-08-05 16:42:23.620626041 -0600
+@@ -11960,6 +11960,8 @@
+ 					PROCWHITELISTED=0
+ 					PROCDELFILES_GIVEN=0
+ 
++                                        IFS=$RKHIFS
++
+ 					for RKHTMPVAR in ${ALLOWPROCDELFILES}; do
+ 						PROCDELFILES_GIVEN=0
+ 
+@@ -11983,6 +11985,8 @@
+ 						fi
+ 					done
+ 
++                                        IFS=$IFSNL
++
+ 					test $HAVE_READLINK -eq 0 && PROC="\"${PROC}\""
+ 
+ 					if [ $PROCWHITELISTED -eq 1 ]; then
diff --git a/rkhunter.spec b/rkhunter.spec
index 99002fd..de286b1 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.8
-Release:        8%{?dist}
+Release:        9%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -12,6 +12,8 @@ Source3:        rkhunter.sysconfig
 Patch0:         rkhunter-1.3.8-fedoraconfig.patch
 # Upstream in http://rkhunter.cvs.sourceforge.net/viewvc/rkhunter/rkhunter/files/rkhunter?r1=1.396&r2=1.397&view=patch
 Patch1:		rkhunter-1.3.8-file.patch
+# Upstream already. 
+Patch2:         rkhunter-1.3.8-ifs.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -30,6 +32,7 @@ and other unwanted tools.
 
 %patch0 -p1
 %patch1 -p1
+%patch2 -p1
 
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}/%{name}.log {
@@ -96,6 +99,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Aug 05 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-9
+- Add patch to fix ALLOWPROCDELFILE config option. fixes bug #727524
+
 * Fri Jul 08 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-8
 - Fix typo
 

From 8b0198deaf40df96e71a09db2687d62f37bd1918 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 15 Oct 2011 17:52:02 -0600
Subject: [PATCH 050/122] Update %files section so that some .dat files are
 marked %ghost

---
 rkhunter.spec | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index de286b1..bc942d1 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.8
-Release:        9%{?dist}
+Release:        10%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -91,6 +91,8 @@ EOF
 %config(noreplace) %{_sysconfdir}/logrotate.d/%{name}
 %dir %{_var}/lib/%{name}
 %{_var}/lib/%{name}/db
+%ghost %{_var}/lib/%{name}/db/mirrors.dat
+%ghost %{_var}/lib/%{name}/db/programs_bad.dat
 %{_var}/lib/%{name}/db/i18n
 %dir %{_var}/log/%{name}
 %config(noreplace) %{_sysconfdir}/%{name}.conf
@@ -99,6 +101,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Oct 12 2011 Jim Pirzyk <jim+rpm@pirzyk.org> - 1.3.8-10
+- Update %files section so that some .dat files are marked %ghost
+
 * Fri Aug 05 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-9
 - Add patch to fix ALLOWPROCDELFILE config option. fixes bug #727524
 

From 6a7d33e0e0bd87a26340f831d6e8fe717913d293 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Fri, 25 Nov 2011 19:39:09 -0700
Subject: [PATCH 051/122] Add /usr/share/man/man5/.k5identity.5.gz to
 whitelisted hidden files.

---
 rkhunter-1.3.8-fedoraconfig.patch | 11 ++++++-----
 rkhunter.spec                     |  5 ++++-
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/rkhunter-1.3.8-fedoraconfig.patch b/rkhunter-1.3.8-fedoraconfig.patch
index 9938e04..e7c17b0 100644
--- a/rkhunter-1.3.8-fedoraconfig.patch
+++ b/rkhunter-1.3.8-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.conf
 --- rkhunter-1.3.8.orig/files/rkhunter.conf	2010-11-13 13:25:22.000000000 -0700
-+++ rkhunter-1.3.8/files/rkhunter.conf	2011-07-08 09:01:31.660923511 -0600
++++ rkhunter-1.3.8/files/rkhunter.conf	2011-11-25 19:28:58.535501320 -0700
 @@ -94,16 +94,19 @@
  # sure that the directory permissions are tight.
  #
@@ -113,7 +113,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Allow the specified hidden files to be whitelisted.
-@@ -519,6 +541,29 @@
+@@ -519,6 +541,30 @@
  #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha384hmac.hmac"
  #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha512hmac.hmac"
  #ALLOWHIDDENFILE="/usr/sbin/.sshd.hmac"
@@ -135,6 +135,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
 +ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
 +ALLOWHIDDENFILE=/dev/.mdadm.map
 +ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz
++ALLOWHIDDENFILE=/usr/share/man/man5/.k5identity.5.gz
 +ALLOWHIDDENFILE=/usr/sbin/.ipsec.hmac
 +# etckeeper
 +ALLOWHIDDENFILE=/etc/.etckeeper
@@ -143,7 +144,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Allow the specified processes to use deleted files. The
-@@ -583,6 +628,12 @@
+@@ -583,6 +629,12 @@
  #
  #ALLOWDEVFILE="/dev/shm/pulse-shm-*"
  #ALLOWDEVFILE="/dev/shm/sem.ADBE_*"
@@ -156,7 +157,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # This setting tells rkhunter where the inetd configuration
-@@ -721,6 +772,7 @@
+@@ -721,6 +773,7 @@
  # The option may be specified more than once.
  #
  #SUSPSCAN_DIRS="/tmp /var/tmp"
@@ -164,7 +165,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Directory for temporary files. A memory-based one is better (faster).
-@@ -976,3 +1028,5 @@
+@@ -976,3 +1029,5 @@
  # both programs, then disable the 'hidden_procs' test.
  #
  #DISABLE_UNHIDE=0
diff --git a/rkhunter.spec b/rkhunter.spec
index bc942d1..8653327 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.8
-Release:        10%{?dist}
+Release:        11%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -101,6 +101,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Nov 25 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-11
+- Add /usr/share/man/man5/.k5identity.5.gz to whitelisted hidden files. 
+
 * Wed Oct 12 2011 Jim Pirzyk <jim+rpm@pirzyk.org> - 1.3.8-10
 - Update %files section so that some .dat files are marked %ghost
 

From a39421eb5395dbbffc8f02e30df74df5ad933c6f Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Fri, 6 Jan 2012 18:30:54 -0700
Subject: [PATCH 052/122] Add /etc/.java to whitelist. Fixes bug #770972

---
 rkhunter-1.3.8-fedoraconfig.patch | 11 +++++++++--
 rkhunter.spec                     |  5 ++++-
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/rkhunter-1.3.8-fedoraconfig.patch b/rkhunter-1.3.8-fedoraconfig.patch
index e7c17b0..2313181 100644
--- a/rkhunter-1.3.8-fedoraconfig.patch
+++ b/rkhunter-1.3.8-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.conf
 --- rkhunter-1.3.8.orig/files/rkhunter.conf	2010-11-13 13:25:22.000000000 -0700
-+++ rkhunter-1.3.8/files/rkhunter.conf	2011-11-25 19:28:58.535501320 -0700
++++ rkhunter-1.3.8/files/rkhunter.conf	2012-01-06 17:55:59.131669432 -0700
 @@ -94,16 +94,19 @@
  # sure that the directory permissions are tight.
  #
@@ -94,7 +94,14 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Allow the specified commands to have the immutable attribute set.
-@@ -495,6 +505,18 @@
+@@ -489,12 +499,24 @@
+ # The option may be specified more than once. The option
+ # may use wildcard characters.
+ #
+-#ALLOWHIDDENDIR="/etc/.java"
++ALLOWHIDDENDIR="/etc/.java"
+ #ALLOWHIDDENDIR="/dev/.udev /dev/.udevdb /dev/.udev.tdb"
+ #ALLOWHIDDENDIR="/dev/.static"
  #ALLOWHIDDENDIR="/dev/.initramfs"
  #ALLOWHIDDENDIR="/dev/.SRC-unix"
  #ALLOWHIDDENDIR="/dev/.mdadm"
diff --git a/rkhunter.spec b/rkhunter.spec
index 8653327..a9c1590 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.8
-Release:        11%{?dist}
+Release:        12%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -101,6 +101,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jan 06 2012 Kevin Fenzi <kevin@scrye.com> 1.3.8-12
+- Add /etc/.java to whitelist. Fixes bug #770972
+
 * Fri Nov 25 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-11
 - Add /usr/share/man/man5/.k5identity.5.gz to whitelisted hidden files. 
 

From d9394f9563f8ba594d44037ca921b85604c2567e Mon Sep 17 00:00:00 2001
From: Peter Robinson <pbrobinson@gmail.com>
Date: Wed, 11 Jan 2012 10:44:29 +0000
Subject: [PATCH 053/122] mktemp was long obsoleted by coreutils

---
 rkhunter.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index a9c1590..8d5233d 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -17,7 +17,7 @@ Patch2:         rkhunter-1.3.8-ifs.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
-Requires:       coreutils, binutils, modutils, findutils, grep, mktemp
+Requires:       coreutils, binutils, modutils, findutils, grep
 Requires:       e2fsprogs, procps, lsof, iproute, net-tools, wget
 Requires:       perl, perl(strict), perl(IO::Socket), mailx, logrotate
 

From 689a5a0a53e940c9d4af4194cb3173e0922e670d Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Fri, 27 Jan 2012 20:42:01 -0700
Subject: [PATCH 054/122] Drop net-tools, no longer needed. Fixes bug #784803

- Add /dev/shm/spice.* to whitelist. Fixes bug #784882
---
 rkhunter-1.3.8-fedoraconfig.patch | 10 ++++++----
 rkhunter.spec                     |  8 ++++++--
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/rkhunter-1.3.8-fedoraconfig.patch b/rkhunter-1.3.8-fedoraconfig.patch
index 2313181..f4c15b3 100644
--- a/rkhunter-1.3.8-fedoraconfig.patch
+++ b/rkhunter-1.3.8-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.conf
 --- rkhunter-1.3.8.orig/files/rkhunter.conf	2010-11-13 13:25:22.000000000 -0700
-+++ rkhunter-1.3.8/files/rkhunter.conf	2012-01-06 17:55:59.131669432 -0700
++++ rkhunter-1.3.8/files/rkhunter.conf	2012-01-27 20:41:00.295582744 -0700
 @@ -94,16 +94,19 @@
  # sure that the directory permissions are tight.
  #
@@ -151,7 +151,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Allow the specified processes to use deleted files. The
-@@ -583,6 +629,12 @@
+@@ -583,6 +629,14 @@
  #
  #ALLOWDEVFILE="/dev/shm/pulse-shm-*"
  #ALLOWDEVFILE="/dev/shm/sem.ADBE_*"
@@ -161,10 +161,12 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
 +ALLOWDEVFILE="/dev/shm/mono.*"
 +# created by libv4l
 +ALLOWDEVFILE="/dev/shm/libv4l-*"
++# created by spice video
++ALLOWDEVFILE="/dev/shm/spice.*"
  
  #
  # This setting tells rkhunter where the inetd configuration
-@@ -721,6 +773,7 @@
+@@ -721,6 +775,7 @@
  # The option may be specified more than once.
  #
  #SUSPSCAN_DIRS="/tmp /var/tmp"
@@ -172,7 +174,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Directory for temporary files. A memory-based one is better (faster).
-@@ -976,3 +1029,5 @@
+@@ -976,3 +1031,5 @@
  # both programs, then disable the 'hidden_procs' test.
  #
  #DISABLE_UNHIDE=0
diff --git a/rkhunter.spec b/rkhunter.spec
index 8d5233d..a891179 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.8
-Release:        12%{?dist}
+Release:        13%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -18,7 +18,7 @@ BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 Requires:       coreutils, binutils, modutils, findutils, grep
-Requires:       e2fsprogs, procps, lsof, iproute, net-tools, wget
+Requires:       e2fsprogs, procps, lsof, iproute, wget
 Requires:       perl, perl(strict), perl(IO::Socket), mailx, logrotate
 
 %description
@@ -101,6 +101,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jan 27 2012 Kevin Fenzi <kevin@scrye.com> 1.3.8-13
+- Drop net-tools, no longer needed. Fixes bug #784803
+- Add /dev/shm/spice.* to whitelist. Fixes bug #784882
+
 * Fri Jan 06 2012 Kevin Fenzi <kevin@scrye.com> 1.3.8-12
 - Add /etc/.java to whitelist. Fixes bug #770972
 

From 9aa802dccbeff044a905bf01334f144fc170db8a Mon Sep 17 00:00:00 2001
From: Kay Sievers <kay.sievers@vrfy.org>
Date: Wed, 8 Feb 2012 19:31:50 +0100
Subject: [PATCH 055/122] modutils are for Linux 2.4 and no longer provided;
 depend on kmod

---
 rkhunter.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index a891179..8c80be9 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.8
-Release:        13%{?dist}
+Release:        14%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -17,7 +17,7 @@ Patch2:         rkhunter-1.3.8-ifs.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
-Requires:       coreutils, binutils, modutils, findutils, grep
+Requires:       coreutils, binutils, kmod, findutils, grep
 Requires:       e2fsprogs, procps, lsof, iproute, wget
 Requires:       perl, perl(strict), perl(IO::Socket), mailx, logrotate
 
@@ -101,6 +101,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Feb  8 2012 Kay Sievers <kay@redhat.com> - 1.3.8-14
+- modutils are for Linux 2.4 and no longer provided; depend on kmod
+
 * Fri Jan 27 2012 Kevin Fenzi <kevin@scrye.com> 1.3.8-13
 - Drop net-tools, no longer needed. Fixes bug #784803
 - Add /dev/shm/spice.* to whitelist. Fixes bug #784882

From c9e5bec9a7bb860b6a2201e7f8b2c19033aa665e Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sun, 15 Apr 2012 13:55:56 -0600
Subject: [PATCH 056/122] Add workaround for /lib/java false positive. Fixes
 bug #806972

---
 rkhunter-1.3.8-fedoraconfig.patch | 12 ++++++++++--
 rkhunter.spec                     |  5 ++++-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/rkhunter-1.3.8-fedoraconfig.patch b/rkhunter-1.3.8-fedoraconfig.patch
index f4c15b3..52bf2a8 100644
--- a/rkhunter-1.3.8-fedoraconfig.patch
+++ b/rkhunter-1.3.8-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.conf
 --- rkhunter-1.3.8.orig/files/rkhunter.conf	2010-11-13 13:25:22.000000000 -0700
-+++ rkhunter-1.3.8/files/rkhunter.conf	2012-01-27 20:41:00.295582744 -0700
++++ rkhunter-1.3.8/files/rkhunter.conf	2012-04-15 13:50:44.806317780 -0600
 @@ -94,16 +94,19 @@
  # sure that the directory permissions are tight.
  #
@@ -174,7 +174,15 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Directory for temporary files. A memory-based one is better (faster).
-@@ -976,3 +1031,5 @@
+@@ -818,6 +873,7 @@
+ # The options may be specified more than once.
+ #
+ #RTKT_DIR_WHITELIST=""
++RTKT_DIR_WHITELIST=/lib/java
+ #RTKT_FILE_WHITELIST=""
+ 
+ #
+@@ -976,3 +1032,5 @@
  # both programs, then disable the 'hidden_procs' test.
  #
  #DISABLE_UNHIDE=0
diff --git a/rkhunter.spec b/rkhunter.spec
index 8c80be9..c1af810 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.3.8
-Release:        14%{?dist}
+Release:        15%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -101,6 +101,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Apr 15 2012 Kevin Fenzi <kevin@scrye.com> 1.3.8-15
+- Add workaround for /lib/java false positive. Fixes bug #806972
+
 * Wed Feb  8 2012 Kay Sievers <kay@redhat.com> - 1.3.8-14
 - modutils are for Linux 2.4 and no longer provided; depend on kmod
 

From 201d715a7ba01b790029f5443cbdb02e0262e920 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Tue, 8 May 2012 08:30:47 -0600
Subject: [PATCH 057/122] Update to 1.4.0

---
 rkhunter-1.3.8-file.patch                     | 21 -------
 rkhunter-1.3.8-ifs.patch                      | 21 -------
 ...patch => rkhunter-1.4.0-fedoraconfig.patch | 55 ++++++++++---------
 rkhunter.spec                                 | 17 +++---
 4 files changed, 35 insertions(+), 79 deletions(-)
 delete mode 100644 rkhunter-1.3.8-file.patch
 delete mode 100644 rkhunter-1.3.8-ifs.patch
 rename rkhunter-1.3.8-fedoraconfig.patch => rkhunter-1.4.0-fedoraconfig.patch (85%)

diff --git a/rkhunter-1.3.8-file.patch b/rkhunter-1.3.8-file.patch
deleted file mode 100644
index 3b35199..0000000
--- a/rkhunter-1.3.8-file.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff -Nur rkhunter-1.3.8.orig/files/rkhunter rkhunter-1.3.8/files/rkhunter
---- rkhunter-1.3.8.orig/files/rkhunter	2010-11-16 17:33:49.000000000 -0700
-+++ rkhunter-1.3.8/files/rkhunter	2011-07-08 08:48:12.930204260 -0600
-@@ -9880,11 +9880,15 @@
- 					test -n "${BASENAME_CMD}" && RKHTMPVAR=`${BASENAME_CMD} ${FNAME}` || RKHTMPVAR=`echo "${FNAME}" | sed -e 's:^.*/::'`
- 
- 					if [ "${RKHTMPVAR}" = "rkhunter" ]; then
--						SYSSCRIPT=`${FILE_CMD} ${FNAME} 2>&1 | tr -s '	' ' ' | cat -v | egrep -i -v '(shell|/bin/sh) script( |$)'`
-+                                               SYSSCRIPT=`${FILE_CMD} ${FNAME} 2>&1 | tr -s '  ' ' ' | cat -v | egrep -i -v '(shell|/bin/sh) script( |,|$)'`
- 					else
--						SYSSCRIPT=`${FILE_CMD} ${FNAME} 2>&1 | tr -s '	' ' ' | cat -v | egrep -i ' script( |$)'`
-+                                               SYSSCRIPT=`${FILE_CMD} ${FNAME} 2>&1 | tr -s '  ' ' ' | cat -v | egrep -i ' script( |,|$)'`
- 					fi
- 
-+
-+                                        else
-+
-+
- 					test -n "${SYSSCRIPT}" && TEST_RESULT="${TEST_RESULT} script"
- 				fi
- 			fi
diff --git a/rkhunter-1.3.8-ifs.patch b/rkhunter-1.3.8-ifs.patch
deleted file mode 100644
index 8c7f476..0000000
--- a/rkhunter-1.3.8-ifs.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff -Nur rkhunter-1.3.8.orig/files/rkhunter rkhunter-1.3.8/files/rkhunter
---- rkhunter-1.3.8.orig/files/rkhunter	2011-08-05 16:44:41.771726323 -0600
-+++ rkhunter-1.3.8/files/rkhunter	2011-08-05 16:42:23.620626041 -0600
-@@ -11960,6 +11960,8 @@
- 					PROCWHITELISTED=0
- 					PROCDELFILES_GIVEN=0
- 
-+                                        IFS=$RKHIFS
-+
- 					for RKHTMPVAR in ${ALLOWPROCDELFILES}; do
- 						PROCDELFILES_GIVEN=0
- 
-@@ -11983,6 +11985,8 @@
- 						fi
- 					done
- 
-+                                        IFS=$IFSNL
-+
- 					test $HAVE_READLINK -eq 0 && PROC="\"${PROC}\""
- 
- 					if [ $PROCWHITELISTED -eq 1 ]; then
diff --git a/rkhunter-1.3.8-fedoraconfig.patch b/rkhunter-1.4.0-fedoraconfig.patch
similarity index 85%
rename from rkhunter-1.3.8-fedoraconfig.patch
rename to rkhunter-1.4.0-fedoraconfig.patch
index 52bf2a8..c9e1db4 100644
--- a/rkhunter-1.3.8-fedoraconfig.patch
+++ b/rkhunter-1.4.0-fedoraconfig.patch
@@ -1,7 +1,7 @@
-diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.conf
---- rkhunter-1.3.8.orig/files/rkhunter.conf	2010-11-13 13:25:22.000000000 -0700
-+++ rkhunter-1.3.8/files/rkhunter.conf	2012-04-15 13:50:44.806317780 -0600
-@@ -94,16 +94,19 @@
+diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.conf
+--- rkhunter-1.4.0.orig/files/rkhunter.conf	2011-12-17 14:36:02.000000000 -0700
++++ rkhunter-1.4.0/files/rkhunter.conf	2012-05-08 06:47:26.140460511 -0600
+@@ -100,16 +100,19 @@
  # sure that the directory permissions are tight.
  #
  #TMPDIR=/var/lib/rkhunter/tmp
@@ -20,8 +20,8 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
 +SCRIPTDIR=/usr/share/rkhunter/scripts
  
  #
- # Specify the root directory to use.
-@@ -155,13 +158,13 @@
+ # This option can be used to modify the command directory list used
+@@ -156,13 +159,13 @@
  #
  # NOTE: This option should be present in the configuration file.
  #
@@ -37,7 +37,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Set the following option to 1 if the log file is to be copied when
-@@ -183,7 +186,7 @@
+@@ -184,7 +187,7 @@
  # Setting the value to 'none', or just leaving the option commented out,
  # disables the use of syslog.
  #
@@ -46,7 +46,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Set the following option to 1 if the second colour set is to be used.
-@@ -213,7 +216,7 @@
+@@ -214,7 +217,7 @@
  # file, then a value here of 'unset' can be used to avoid warning messages.
  # This option has a default value of 'no'.
  #
@@ -55,7 +55,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Set this option to '1' to allow the use of the SSH-1 protocol, but note
-@@ -224,7 +227,7 @@
+@@ -225,7 +228,7 @@
  # configuration file, then a value of '2' may be set here in order to
  # suppress a warning message. This option has a default value of '0'.
  #
@@ -64,7 +64,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # This setting tells rkhunter the directory containing the SSH configuration
-@@ -255,7 +258,7 @@
+@@ -256,7 +259,7 @@
  # tests, the test names, and how rkhunter behaves when these options are used.
  #
  ENABLE_TESTS="all"
@@ -73,15 +73,16 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # The HASH_FUNC option can be used to specify the command to use
-@@ -324,6 +327,7 @@
+@@ -324,7 +327,7 @@
+ #
  # Whenever this option is changed 'rkhunter --propupd' must be run.
  #
- #PKGMGR=NONE
+-#PKGMGR=NONE
 +PKGMGR=RPM
  
  #
  # It is possible that a file which is part of a package may be modified
-@@ -466,6 +470,12 @@
+@@ -468,6 +471,12 @@
  #
  #SCRIPTWHITELIST="/sbin/ifup /sbin/ifdown"
  #SCRIPTWHITELIST="/usr/bin/groups"
@@ -94,7 +95,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Allow the specified commands to have the immutable attribute set.
-@@ -489,12 +499,24 @@
+@@ -491,12 +500,24 @@
  # The option may be specified more than once. The option
  # may use wildcard characters.
  #
@@ -120,11 +121,19 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Allow the specified hidden files to be whitelisted.
-@@ -519,6 +541,30 @@
+@@ -506,7 +527,7 @@
+ # characters.
+ # 
+ #ALLOWHIDDENFILE="/etc/.java"
+-#ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz"
++ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz"
+ #ALLOWHIDDENFILE="/etc/.pwd.lock"
+ #ALLOWHIDDENFILE="/etc/.init.state"
+ #ALLOWHIDDENFILE="/lib/.libcrypto.so.0.9.8e.hmac /lib/.libcrypto.so.6.hmac"
+@@ -521,6 +542,29 @@
  #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha384hmac.hmac"
  #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha512hmac.hmac"
  #ALLOWHIDDENFILE="/usr/sbin/.sshd.hmac"
-+ALLOWHIDDENFILE=/usr/share/man/man1/..1.gz
 +ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac
 +ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac
 +ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
@@ -151,7 +160,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Allow the specified processes to use deleted files. The
-@@ -583,6 +629,14 @@
+@@ -586,6 +630,14 @@
  #
  #ALLOWDEVFILE="/dev/shm/pulse-shm-*"
  #ALLOWDEVFILE="/dev/shm/sem.ADBE_*"
@@ -166,7 +175,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # This setting tells rkhunter where the inetd configuration
-@@ -721,6 +775,7 @@
+@@ -724,6 +776,7 @@
  # The option may be specified more than once.
  #
  #SUSPSCAN_DIRS="/tmp /var/tmp"
@@ -174,15 +183,7 @@ diff -Nur rkhunter-1.3.8.orig/files/rkhunter.conf rkhunter-1.3.8/files/rkhunter.
  
  #
  # Directory for temporary files. A memory-based one is better (faster).
-@@ -818,6 +873,7 @@
- # The options may be specified more than once.
- #
- #RTKT_DIR_WHITELIST=""
-+RTKT_DIR_WHITELIST=/lib/java
- #RTKT_FILE_WHITELIST=""
- 
- #
-@@ -976,3 +1032,5 @@
+@@ -980,3 +1033,5 @@
  # both programs, then disable the 'hidden_procs' test.
  #
  #DISABLE_UNHIDE=0
diff --git a/rkhunter.spec b/rkhunter.spec
index c1af810..4d2c049 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
-Version:        1.3.8
-Release:        15%{?dist}
+Version:        1.4.0
+Release:        1%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -9,11 +9,7 @@ URL:            http://rkhunter.sourceforge.net/
 Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
-Patch0:         rkhunter-1.3.8-fedoraconfig.patch
-# Upstream in http://rkhunter.cvs.sourceforge.net/viewvc/rkhunter/rkhunter/files/rkhunter?r1=1.396&r2=1.397&view=patch
-Patch1:		rkhunter-1.3.8-file.patch
-# Upstream already. 
-Patch2:         rkhunter-1.3.8-ifs.patch
+Patch0:         rkhunter-1.4.0-fedoraconfig.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -31,8 +27,6 @@ and other unwanted tools.
 %setup -q
 
 %patch0 -p1
-%patch1 -p1
-%patch2 -p1
 
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}/%{name}.log {
@@ -101,7 +95,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
-* Sun Apr 15 2012 Kevin Fenzi <kevin@scrye.com> 1.3.8-15
+* Tue May 08 2012 Kevin Fenzi <kevin@scrye.com> - 1.4.0-1
+- Update to 1.4.0
+
+* Sun Apr 15 2012 Kevin Fenzi <kevin@scrye.com> - 1.3.8-15
 - Add workaround for /lib/java false positive. Fixes bug #806972
 
 * Wed Feb  8 2012 Kay Sievers <kay@redhat.com> - 1.3.8-14

From 682091453313de891be7aeda6628fd0ba3d6f437 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Tue, 8 May 2012 08:37:55 -0600
Subject: [PATCH 058/122] Actually upload new sources too.

---
 .gitignore | 1 +
 sources    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index d8de726..ddd820d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 rkhunter-1.3.6.tar.gz
 /rkhunter-1.3.8.tar.gz
+/rkhunter-1.4.0.tar.gz
diff --git a/sources b/sources
index 4445e10..01cf4f6 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-0c34eb2a2d0caa384f442c11fcbb0c46  rkhunter-1.3.8.tar.gz
+37b1ceb79a5ff3debca335d6550ac6b0  rkhunter-1.4.0.tar.gz

From c7816676ace8e863aea7acd31b385973868650c3 Mon Sep 17 00:00:00 2001
From: Dennis Gilmore <dennis@ausil.us>
Date: Sat, 21 Jul 2012 11:33:50 -0500
Subject: [PATCH 059/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 4d2c049..977ce3c 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.4.0
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -95,6 +95,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
 * Tue May 08 2012 Kevin Fenzi <kevin@scrye.com> - 1.4.0-1
 - Update to 1.4.0
 

From bdce6211641870c688e210c0a7ed4ca2d1dbe4a3 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Wed, 15 Aug 2012 13:57:33 -0600
Subject: [PATCH 060/122] Fix /bin/ad false positive. Fixes bug #831989

---
 rkhunter-1.4.0-fedoraconfig.patch | 32 +++++++++++++++++++++++--------
 rkhunter.spec                     |  5 ++++-
 2 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/rkhunter-1.4.0-fedoraconfig.patch b/rkhunter-1.4.0-fedoraconfig.patch
index c9e1db4..c806ca4 100644
--- a/rkhunter-1.4.0-fedoraconfig.patch
+++ b/rkhunter-1.4.0-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.conf
 --- rkhunter-1.4.0.orig/files/rkhunter.conf	2011-12-17 14:36:02.000000000 -0700
-+++ rkhunter-1.4.0/files/rkhunter.conf	2012-05-08 06:47:26.140460511 -0600
++++ rkhunter-1.4.0/files/rkhunter.conf	2012-08-15 13:21:16.431852436 -0600
 @@ -100,16 +100,19 @@
  # sure that the directory permissions are tight.
  #
@@ -82,7 +82,15 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  
  #
  # It is possible that a file which is part of a package may be modified
-@@ -468,6 +471,12 @@
+@@ -433,6 +436,7 @@
+ # for each new file, and rkhunter will report this.
+ #
+ #EXISTWHITELIST=""
++EXITWHITELIST=/bin/ad
+ 
+ #
+ # Whitelist various attributes of the specified files.
+@@ -468,6 +472,12 @@
  #
  #SCRIPTWHITELIST="/sbin/ifup /sbin/ifdown"
  #SCRIPTWHITELIST="/usr/bin/groups"
@@ -95,7 +103,7 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  
  #
  # Allow the specified commands to have the immutable attribute set.
-@@ -491,12 +500,24 @@
+@@ -491,12 +501,24 @@
  # The option may be specified more than once. The option
  # may use wildcard characters.
  #
@@ -121,7 +129,7 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  
  #
  # Allow the specified hidden files to be whitelisted.
-@@ -506,7 +527,7 @@
+@@ -506,7 +528,7 @@
  # characters.
  # 
  #ALLOWHIDDENFILE="/etc/.java"
@@ -130,7 +138,7 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  #ALLOWHIDDENFILE="/etc/.pwd.lock"
  #ALLOWHIDDENFILE="/etc/.init.state"
  #ALLOWHIDDENFILE="/lib/.libcrypto.so.0.9.8e.hmac /lib/.libcrypto.so.6.hmac"
-@@ -521,6 +542,29 @@
+@@ -521,6 +543,29 @@
  #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha384hmac.hmac"
  #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha512hmac.hmac"
  #ALLOWHIDDENFILE="/usr/sbin/.sshd.hmac"
@@ -160,7 +168,7 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  
  #
  # Allow the specified processes to use deleted files. The
-@@ -586,6 +630,14 @@
+@@ -586,6 +631,14 @@
  #
  #ALLOWDEVFILE="/dev/shm/pulse-shm-*"
  #ALLOWDEVFILE="/dev/shm/sem.ADBE_*"
@@ -175,7 +183,7 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  
  #
  # This setting tells rkhunter where the inetd configuration
-@@ -724,6 +776,7 @@
+@@ -724,6 +777,7 @@
  # The option may be specified more than once.
  #
  #SUSPSCAN_DIRS="/tmp /var/tmp"
@@ -183,7 +191,15 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  
  #
  # Directory for temporary files. A memory-based one is better (faster).
-@@ -980,3 +1033,5 @@
+@@ -822,6 +876,7 @@
+ #
+ #RTKT_DIR_WHITELIST=""
+ #RTKT_FILE_WHITELIST=""
++RTKT_FILE_WHITELIST=/bin/ad
+ 
+ #
+ # The following option can be used to whitelist shared library files that would
+@@ -980,3 +1035,5 @@
  # both programs, then disable the 'hidden_procs' test.
  #
  #DISABLE_UNHIDE=0
diff --git a/rkhunter.spec b/rkhunter.spec
index 977ce3c..0dc375a 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.4.0
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -95,6 +95,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Aug 15 2012 Kevin Fenzi <kevin@scrye.com> 1.4.0-3
+- Fix /bin/ad false positive. Fixes bug #831989
+
 * Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.0-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
 

From 19d7be3df9eaf7654a0e954d45671e0eb2ea85b4 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 18 Aug 2012 14:24:33 -0600
Subject: [PATCH 061/122] Add /var/log/pki-ca/system to whitelist for FreeIPA.
 Fixes bug #849251

---
 rkhunter-1.4.0-fedoraconfig.patch | 27 ++++++++++++++++-----------
 rkhunter.spec                     |  5 ++++-
 2 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/rkhunter-1.4.0-fedoraconfig.patch b/rkhunter-1.4.0-fedoraconfig.patch
index c806ca4..ae4e359 100644
--- a/rkhunter-1.4.0-fedoraconfig.patch
+++ b/rkhunter-1.4.0-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.conf
 --- rkhunter-1.4.0.orig/files/rkhunter.conf	2011-12-17 14:36:02.000000000 -0700
-+++ rkhunter-1.4.0/files/rkhunter.conf	2012-08-15 13:21:16.431852436 -0600
++++ rkhunter-1.4.0/files/rkhunter.conf	2012-08-18 14:22:35.766205387 -0600
 @@ -100,16 +100,19 @@
  # sure that the directory permissions are tight.
  #
@@ -82,15 +82,17 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  
  #
  # It is possible that a file which is part of a package may be modified
-@@ -433,6 +436,7 @@
+@@ -433,6 +436,9 @@
  # for each new file, and rkhunter will report this.
  #
  #EXISTWHITELIST=""
 +EXITWHITELIST=/bin/ad
++# FreeIPA Certificate Authority
++EXITWHITELIST=/var/log/pki-ca/system
  
  #
  # Whitelist various attributes of the specified files.
-@@ -468,6 +472,12 @@
+@@ -468,6 +474,12 @@
  #
  #SCRIPTWHITELIST="/sbin/ifup /sbin/ifdown"
  #SCRIPTWHITELIST="/usr/bin/groups"
@@ -103,7 +105,7 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  
  #
  # Allow the specified commands to have the immutable attribute set.
-@@ -491,12 +501,24 @@
+@@ -491,12 +503,24 @@
  # The option may be specified more than once. The option
  # may use wildcard characters.
  #
@@ -129,7 +131,7 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  
  #
  # Allow the specified hidden files to be whitelisted.
-@@ -506,7 +528,7 @@
+@@ -506,7 +530,7 @@
  # characters.
  # 
  #ALLOWHIDDENFILE="/etc/.java"
@@ -138,7 +140,7 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  #ALLOWHIDDENFILE="/etc/.pwd.lock"
  #ALLOWHIDDENFILE="/etc/.init.state"
  #ALLOWHIDDENFILE="/lib/.libcrypto.so.0.9.8e.hmac /lib/.libcrypto.so.6.hmac"
-@@ -521,6 +543,29 @@
+@@ -521,6 +545,29 @@
  #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha384hmac.hmac"
  #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha512hmac.hmac"
  #ALLOWHIDDENFILE="/usr/sbin/.sshd.hmac"
@@ -168,7 +170,7 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  
  #
  # Allow the specified processes to use deleted files. The
-@@ -586,6 +631,14 @@
+@@ -586,6 +633,14 @@
  #
  #ALLOWDEVFILE="/dev/shm/pulse-shm-*"
  #ALLOWDEVFILE="/dev/shm/sem.ADBE_*"
@@ -183,7 +185,7 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  
  #
  # This setting tells rkhunter where the inetd configuration
-@@ -724,6 +777,7 @@
+@@ -724,6 +779,7 @@
  # The option may be specified more than once.
  #
  #SUSPSCAN_DIRS="/tmp /var/tmp"
@@ -191,15 +193,18 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  
  #
  # Directory for temporary files. A memory-based one is better (faster).
-@@ -822,6 +876,7 @@
+@@ -822,7 +878,9 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
+-
 +RTKT_FILE_WHITELIST=/bin/ad
- 
++# FreeIPA Certificate Authority
++RTKT_FILE_WHITELIST=/var/log/pki-ca/system
  #
  # The following option can be used to whitelist shared library files that would
-@@ -980,3 +1035,5 @@
+ # normally be flagged with a warning during the preloaded shared library check.
+@@ -980,3 +1038,5 @@
  # both programs, then disable the 'hidden_procs' test.
  #
  #DISABLE_UNHIDE=0
diff --git a/rkhunter.spec b/rkhunter.spec
index 0dc375a..05eac1e 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.4.0
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -95,6 +95,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Aug 18 2012 Kevin Fenzi <kevin@scrye.com> 1.4.0-4
+- Add /var/log/pki-ca/system to whitelist for FreeIPA. Fixes bug #849251
+
 * Wed Aug 15 2012 Kevin Fenzi <kevin@scrye.com> 1.4.0-3
 - Fix /bin/ad false positive. Fixes bug #831989
 

From a35ed5a4b16ae803efa7fd074e43969139f431d3 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 6 Oct 2012 14:03:29 -0600
Subject: [PATCH 062/122] Add /dev/md/autorebuild.pid to whitelist. Fixes bug
 #857315

---
 rkhunter-1.4.0-fedoraconfig.patch | 16 +++++++++-------
 rkhunter.spec                     |  5 ++++-
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/rkhunter-1.4.0-fedoraconfig.patch b/rkhunter-1.4.0-fedoraconfig.patch
index ae4e359..6fee78d 100644
--- a/rkhunter-1.4.0-fedoraconfig.patch
+++ b/rkhunter-1.4.0-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.conf
 --- rkhunter-1.4.0.orig/files/rkhunter.conf	2011-12-17 14:36:02.000000000 -0700
-+++ rkhunter-1.4.0/files/rkhunter.conf	2012-08-18 14:22:35.766205387 -0600
++++ rkhunter-1.4.0/files/rkhunter.conf	2012-10-06 13:43:28.030872769 -0600
 @@ -100,16 +100,19 @@
  # sure that the directory permissions are tight.
  #
@@ -86,9 +86,9 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  # for each new file, and rkhunter will report this.
  #
  #EXISTWHITELIST=""
-+EXITWHITELIST=/bin/ad
++EXISTWHITELIST=/bin/ad
 +# FreeIPA Certificate Authority
-+EXITWHITELIST=/var/log/pki-ca/system
++EXISTWHITELIST=/var/log/pki-ca/system
  
  #
  # Whitelist various attributes of the specified files.
@@ -170,7 +170,7 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  
  #
  # Allow the specified processes to use deleted files. The
-@@ -586,6 +633,14 @@
+@@ -586,6 +633,16 @@
  #
  #ALLOWDEVFILE="/dev/shm/pulse-shm-*"
  #ALLOWDEVFILE="/dev/shm/sem.ADBE_*"
@@ -182,10 +182,12 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
 +ALLOWDEVFILE="/dev/shm/libv4l-*"
 +# created by spice video
 +ALLOWDEVFILE="/dev/shm/spice.*"
++# created by mdadm
++ALLOWDEVFILE="/dev/md/autorebuild.pid"
  
  #
  # This setting tells rkhunter where the inetd configuration
-@@ -724,6 +779,7 @@
+@@ -724,6 +781,7 @@
  # The option may be specified more than once.
  #
  #SUSPSCAN_DIRS="/tmp /var/tmp"
@@ -193,7 +195,7 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  
  #
  # Directory for temporary files. A memory-based one is better (faster).
-@@ -822,7 +878,9 @@
+@@ -822,7 +880,9 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -204,7 +206,7 @@ diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.
  #
  # The following option can be used to whitelist shared library files that would
  # normally be flagged with a warning during the preloaded shared library check.
-@@ -980,3 +1038,5 @@
+@@ -980,3 +1040,5 @@
  # both programs, then disable the 'hidden_procs' test.
  #
  #DISABLE_UNHIDE=0
diff --git a/rkhunter.spec b/rkhunter.spec
index 05eac1e..5b1af23 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.4.0
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -95,6 +95,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Oct 06 2012 Kevin Fenzi <kevin@scrye.com> 1.4.0-5
+- Add /dev/md/autorebuild.pid to whitelist. Fixes bug #857315
+
 * Sat Aug 18 2012 Kevin Fenzi <kevin@scrye.com> 1.4.0-4
 - Add /var/log/pki-ca/system to whitelist for FreeIPA. Fixes bug #849251
 

From 948ba9c2995ced38340460926f4a5fb3d13be670 Mon Sep 17 00:00:00 2001
From: Dennis Gilmore <dennis@ausil.us>
Date: Thu, 14 Feb 2013 15:44:25 -0600
Subject: [PATCH 063/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 5b1af23..54fde1a 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.4.0
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -95,6 +95,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.0-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
+
 * Sat Oct 06 2012 Kevin Fenzi <kevin@scrye.com> 1.4.0-5
 - Add /dev/md/autorebuild.pid to whitelist. Fixes bug #857315
 

From 647e1a6803e6fd92b319713b68273c534b242ddc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Wed, 17 Jul 2013 09:32:26 +0200
Subject: [PATCH 064/122] Perl 5.18 rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 54fde1a..b6ce2fc 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,6 @@
 Name:           rkhunter
 Version:        1.4.0
-Release:        6%{?dist}
+Release:        7%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -95,6 +95,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Jul 17 2013 Petr Pisar <ppisar@redhat.com> - 1.4.0-7
+- Perl 5.18 rebuild
+
 * Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.0-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
 

From 522eeaf9895ea96e8660d3d9e7459fc4d56b2afb Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 27 Jul 2013 10:32:04 -0600
Subject: [PATCH 065/122] Fix for unversioned docs

- Requires: crontabs. Fixes bug #989110
---
 rkhunter.spec | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index b6ce2fc..34ae43c 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -1,6 +1,9 @@
+# In f20+ use unversioned docdirs, otherwise the old versioned one
+%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
+
 Name:           rkhunter
 Version:        1.4.0
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -16,6 +19,7 @@ BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 Requires:       coreutils, binutils, kmod, findutils, grep
 Requires:       e2fsprogs, procps, lsof, iproute, wget
 Requires:       perl, perl(strict), perl(IO::Socket), mailx, logrotate
+Requires:       crontabs
 
 %description
 Rootkit Hunter (RKH) is an easy-to-use tool which checks
@@ -45,7 +49,7 @@ EOF
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_bindir}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_sysconfdir}/{cron.daily,sysconfig,logrotate.d}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts
-%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/log/%{name}
@@ -59,9 +63,9 @@ EOF
 %{__install} -m644 -p files/i18n/cn             ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n/
 %{__install} -m644 -p files/i18n/en             ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n/
 
-%{__install} -m644 -p files/CHANGELOG           ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
-%{__install} -m644 -p files/LICENSE             ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
-%{__install} -m644 -p files/README              ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/
+%{__install} -m644 -p files/CHANGELOG           ${RPM_BUILD_ROOT}%{_pkgdocdir}
+%{__install} -m644 -p files/LICENSE             ${RPM_BUILD_ROOT}%{_pkgdocdir}
+%{__install} -m644 -p files/README              ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %{__install} -m755 -p files/check_modules.pl    ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/
 %{__install} -m644 -p files/*.8                 ${RPM_BUILD_ROOT}%{_mandir}/man8/
 # Don't ship these unless we want to Require the perl modules
@@ -77,7 +81,7 @@ EOF
 
 %files
 %defattr(-,root,root,-)
-%doc %{_docdir}/%{name}-%{version}/*
+%doc %{_pkgdocdir}/*
 %{_bindir}/%{name}
 %dir %{_datadir}/%{name}
 %{_datadir}/%{name}/scripts
@@ -91,10 +95,14 @@ EOF
 %dir %{_var}/log/%{name}
 %config(noreplace) %{_sysconfdir}/%{name}.conf
 %config(noreplace) %{_sysconfdir}/sysconfig/%{name}
-%dir %{_docdir}/%{name}-%{version}
+%dir %{_pkgdocdir}
 %{_mandir}/man8/*
 
 %changelog
+* Sat Jul 27 2013 Kevin Fenzi <kevin@scrye.com> 1.4.0-8
+- Fix for unversioned docs
+- Requires: crontabs. Fixes bug #989110
+
 * Wed Jul 17 2013 Petr Pisar <ppisar@redhat.com> - 1.4.0-7
 - Perl 5.18 rebuild
 

From 5a99a43eca178b4a71065b41ad6b11b2fd927c7d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Sat, 3 Aug 2013 12:41:27 +0200
Subject: [PATCH 066/122] Perl 5.18 rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 34ae43c..4371500 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.0
-Release:        8%{?dist}
+Release:        9%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -99,6 +99,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Aug 03 2013 Petr Pisar <ppisar@redhat.com> - 1.4.0-9
+- Perl 5.18 rebuild
+
 * Sat Jul 27 2013 Kevin Fenzi <kevin@scrye.com> 1.4.0-8
 - Fix for unversioned docs
 - Requires: crontabs. Fixes bug #989110

From bc6587ce481fc46bd4a88c21fd84cc388370df42 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sun, 1 Sep 2013 13:07:20 -0600
Subject: [PATCH 067/122] Add patch for now to help spaces in allowdev file
 handling. Fixes bug #984180

---
 rkhunter-1.4.0-allowdevfile-space.patch | 21 +++++++++++++++++++++
 rkhunter.spec                           |  8 ++++++++
 2 files changed, 29 insertions(+)
 create mode 100644 rkhunter-1.4.0-allowdevfile-space.patch

diff --git a/rkhunter-1.4.0-allowdevfile-space.patch b/rkhunter-1.4.0-allowdevfile-space.patch
new file mode 100644
index 0000000..74d06f2
--- /dev/null
+++ b/rkhunter-1.4.0-allowdevfile-space.patch
@@ -0,0 +1,21 @@
+diff -Nur rkhunter-1.4.0.orig/files/rkhunter rkhunter-1.4.0/files/rkhunter
+--- rkhunter-1.4.0.orig/files/rkhunter	2012-05-01 09:14:11.000000000 -0600
++++ rkhunter-1.4.0/files/rkhunter	2013-09-01 13:05:39.260244636 -0600
+@@ -3593,14 +3593,14 @@
+ 	ALLOWDEVFILE_OPT=`get_option 2 multi ALLOWDEVFILE` || exit 1
+ 
+ 	if [ -n "${ALLOWDEVFILE_OPT}" ]; then
++
++		check_paths ALLOWDEVFILE_OPT ALLOWDEVFILE
++
+ 		#
+ 		# We 'echo' the variable so that any wildcards get expanded.
+ 		#
+ 
+ 		ALLOWDEVFILES=`echo ${ALLOWDEVFILE_OPT}`
+-
+-		check_paths ALLOWDEVFILES ALLOWDEVFILE
+-
+ 		ALLOWDEVFILES=`echo " ${ALLOWDEVFILES} " | tr '%' ' '`
+ 	fi
+ 
diff --git a/rkhunter.spec b/rkhunter.spec
index 4371500..9742e40 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -13,6 +13,9 @@ Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.ta
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
 Patch0:         rkhunter-1.4.0-fedoraconfig.patch
+# Patch to help with spaces in allow dev file. 
+# https://bugzilla.redhat.com/show_bug.cgi?id=984180
+Patch1:         rkhunter-1.4.0-allowdevfile-space.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -32,6 +35,8 @@ and other unwanted tools.
 
 %patch0 -p1
 
+%patch1 -p1
+
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}/%{name}.log {
     weekly
@@ -99,6 +104,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Sep 01 2013 Kevin Fenzi <kevin@scrye.com> 1.4.0-9
+- Add patch for now to help spaces in allowdev file handling. Fixes bug #984180
+
 * Sat Aug 03 2013 Petr Pisar <ppisar@redhat.com> - 1.4.0-9
 - Perl 5.18 rebuild
 

From 564630b7cfcb08e6fb93facea915bd777101889a Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Fri, 14 Mar 2014 10:14:33 -0600
Subject: [PATCH 068/122] Update to 1.4.2

---
 .gitignore                              |   1 +
 rkhunter-1.4.0-allowdevfile-space.patch |  21 ---
 rkhunter-1.4.0-fedoraconfig.patch       | 214 ------------------------
 rkhunter-1.4.2-fedoraconfig.patch       | 186 ++++++++++++++++++++
 rkhunter.spec                           |  14 +-
 sources                                 |   2 +-
 6 files changed, 194 insertions(+), 244 deletions(-)
 delete mode 100644 rkhunter-1.4.0-allowdevfile-space.patch
 delete mode 100644 rkhunter-1.4.0-fedoraconfig.patch
 create mode 100644 rkhunter-1.4.2-fedoraconfig.patch

diff --git a/.gitignore b/.gitignore
index ddd820d..8ffe1c8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 rkhunter-1.3.6.tar.gz
 /rkhunter-1.3.8.tar.gz
 /rkhunter-1.4.0.tar.gz
+/rkhunter-1.4.2.tar.gz
diff --git a/rkhunter-1.4.0-allowdevfile-space.patch b/rkhunter-1.4.0-allowdevfile-space.patch
deleted file mode 100644
index 74d06f2..0000000
--- a/rkhunter-1.4.0-allowdevfile-space.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff -Nur rkhunter-1.4.0.orig/files/rkhunter rkhunter-1.4.0/files/rkhunter
---- rkhunter-1.4.0.orig/files/rkhunter	2012-05-01 09:14:11.000000000 -0600
-+++ rkhunter-1.4.0/files/rkhunter	2013-09-01 13:05:39.260244636 -0600
-@@ -3593,14 +3593,14 @@
- 	ALLOWDEVFILE_OPT=`get_option 2 multi ALLOWDEVFILE` || exit 1
- 
- 	if [ -n "${ALLOWDEVFILE_OPT}" ]; then
-+
-+		check_paths ALLOWDEVFILE_OPT ALLOWDEVFILE
-+
- 		#
- 		# We 'echo' the variable so that any wildcards get expanded.
- 		#
- 
- 		ALLOWDEVFILES=`echo ${ALLOWDEVFILE_OPT}`
--
--		check_paths ALLOWDEVFILES ALLOWDEVFILE
--
- 		ALLOWDEVFILES=`echo " ${ALLOWDEVFILES} " | tr '%' ' '`
- 	fi
- 
diff --git a/rkhunter-1.4.0-fedoraconfig.patch b/rkhunter-1.4.0-fedoraconfig.patch
deleted file mode 100644
index 6fee78d..0000000
--- a/rkhunter-1.4.0-fedoraconfig.patch
+++ /dev/null
@@ -1,214 +0,0 @@
-diff -Nur rkhunter-1.4.0.orig/files/rkhunter.conf rkhunter-1.4.0/files/rkhunter.conf
---- rkhunter-1.4.0.orig/files/rkhunter.conf	2011-12-17 14:36:02.000000000 -0700
-+++ rkhunter-1.4.0/files/rkhunter.conf	2012-10-06 13:43:28.030872769 -0600
-@@ -100,16 +100,19 @@
- # sure that the directory permissions are tight.
- #
- #TMPDIR=/var/lib/rkhunter/tmp
-+TMPDIR=/var/lib/rkhunter
- 
- #
- # Specify the database directory to use.
- #
- #DBDIR=/var/lib/rkhunter/db
-+DBDIR=/var/lib/rkhunter/db
- 
- #
- # Specify the script directory to use.
- #
- #SCRIPTDIR=/usr/local/lib/rkhunter/scripts
-+SCRIPTDIR=/usr/share/rkhunter/scripts
- 
- #
- # This option can be used to modify the command directory list used
-@@ -156,13 +159,13 @@
- #
- # NOTE: This option should be present in the configuration file.
- #
--LOGFILE=/var/log/rkhunter.log
-+LOGFILE=/var/log/rkhunter/rkhunter.log
- 
- #
- # Set the following option to 1 if the log file is to be appended to
- # whenever rkhunter is run.
- #
--APPEND_LOG=0
-+APPEND_LOG=1
- 
- #
- # Set the following option to 1 if the log file is to be copied when
-@@ -184,7 +187,7 @@
- # Setting the value to 'none', or just leaving the option commented out,
- # disables the use of syslog.
- #
--#USE_SYSLOG=authpriv.notice
-+USE_SYSLOG=authpriv.notice
- 
- #
- # Set the following option to 1 if the second colour set is to be used.
-@@ -214,7 +217,7 @@
- # file, then a value here of 'unset' can be used to avoid warning messages.
- # This option has a default value of 'no'.
- #
--ALLOW_SSH_ROOT_USER=no
-+ALLOW_SSH_ROOT_USER=unset
- 
- #
- # Set this option to '1' to allow the use of the SSH-1 protocol, but note
-@@ -225,7 +228,7 @@
- # configuration file, then a value of '2' may be set here in order to
- # suppress a warning message. This option has a default value of '0'.
- #
--ALLOW_SSH_PROT_V1=0
-+ALLOW_SSH_PROT_V1=2
- 
- #
- # This setting tells rkhunter the directory containing the SSH configuration
-@@ -256,7 +259,7 @@
- # tests, the test names, and how rkhunter behaves when these options are used.
- #
- ENABLE_TESTS="all"
--DISABLE_TESTS="suspscan hidden_ports hidden_procs deleted_files packet_cap_apps"
-+DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps apps"
- 
- #
- # The HASH_FUNC option can be used to specify the command to use
-@@ -324,7 +327,7 @@
- #
- # Whenever this option is changed 'rkhunter --propupd' must be run.
- #
--#PKGMGR=NONE
-+PKGMGR=RPM
- 
- #
- # It is possible that a file which is part of a package may be modified
-@@ -433,6 +436,9 @@
- # for each new file, and rkhunter will report this.
- #
- #EXISTWHITELIST=""
-+EXISTWHITELIST=/bin/ad
-+# FreeIPA Certificate Authority
-+EXISTWHITELIST=/var/log/pki-ca/system
- 
- #
- # Whitelist various attributes of the specified files.
-@@ -468,6 +474,12 @@
- #
- #SCRIPTWHITELIST="/sbin/ifup /sbin/ifdown"
- #SCRIPTWHITELIST="/usr/bin/groups"
-+SCRIPTWHITELIST=/usr/bin/whatis
-+SCRIPTWHITELIST=/usr/bin/ldd
-+SCRIPTWHITELIST=/usr/bin/groups
-+SCRIPTWHITELIST=/usr/bin/GET
-+SCRIPTWHITELIST=/sbin/ifup
-+SCRIPTWHITELIST=/sbin/ifdown
- 
- #
- # Allow the specified commands to have the immutable attribute set.
-@@ -491,12 +503,24 @@
- # The option may be specified more than once. The option
- # may use wildcard characters.
- #
--#ALLOWHIDDENDIR="/etc/.java"
-+ALLOWHIDDENDIR="/etc/.java"
- #ALLOWHIDDENDIR="/dev/.udev /dev/.udevdb /dev/.udev.tdb"
- #ALLOWHIDDENDIR="/dev/.static"
- #ALLOWHIDDENDIR="/dev/.initramfs"
- #ALLOWHIDDENDIR="/dev/.SRC-unix"
- #ALLOWHIDDENDIR="/dev/.mdadm"
-+ALLOWHIDDENDIR=/dev/.udev
-+ALLOWHIDDENDIR=/dev/.udevdb
-+ALLOWHIDDENDIR=/dev/.udev.tdb
-+ALLOWHIDDENDIR=/dev/.static
-+ALLOWHIDDENDIR=/dev/.initramfs
-+ALLOWHIDDENDIR=/dev/.SRC-unix
-+ALLOWHIDDENDIR=/dev/.mdadm
-+ALLOWHIDDENDIR=/dev/.systemd
-+ALLOWHIDDENDIR=/dev/.mount
-+# for etckeeper
-+ALLOWHIDDENDIR=/etc/.git
-+ALLOWHIDDENDIR=/etc/.bzr
- 
- #
- # Allow the specified hidden files to be whitelisted.
-@@ -506,7 +530,7 @@
- # characters.
- # 
- #ALLOWHIDDENFILE="/etc/.java"
--#ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz"
-+ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz"
- #ALLOWHIDDENFILE="/etc/.pwd.lock"
- #ALLOWHIDDENFILE="/etc/.init.state"
- #ALLOWHIDDENFILE="/lib/.libcrypto.so.0.9.8e.hmac /lib/.libcrypto.so.6.hmac"
-@@ -521,6 +545,29 @@
- #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha384hmac.hmac"
- #ALLOWHIDDENFILE="/usr/lib/hmaccalc/sha512hmac.hmac"
- #ALLOWHIDDENFILE="/usr/sbin/.sshd.hmac"
-+ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac
-+ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac
-+ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
-+ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
-+ALLOWHIDDENFILE=/usr/bin/.ssh-keygen.hmac
-+ALLOWHIDDENFILE=/usr/bin/.ssh-keyscan.hmac
-+ALLOWHIDDENFILE=/usr/bin/.ssh-add.hmac
-+ALLOWHIDDENFILE=/usr/bin/.ssh-agent.hmac
-+ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.*.hmac
-+ALLOWHIDDENFILE=/usr/lib*/.libgcrypt.so.*.hmac
-+ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha1hmac.hmac
-+ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha256hmac.hmac
-+ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha384hmac.hmac
-+ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha512hmac.hmac
-+ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
-+ALLOWHIDDENFILE=/dev/.mdadm.map
-+ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz
-+ALLOWHIDDENFILE=/usr/share/man/man5/.k5identity.5.gz
-+ALLOWHIDDENFILE=/usr/sbin/.ipsec.hmac
-+# etckeeper
-+ALLOWHIDDENFILE=/etc/.etckeeper
-+ALLOWHIDDENFILE=/etc/.gitignore
-+ALLOWHIDDENFILE=/etc/.bzrignore
- 
- #
- # Allow the specified processes to use deleted files. The
-@@ -586,6 +633,16 @@
- #
- #ALLOWDEVFILE="/dev/shm/pulse-shm-*"
- #ALLOWDEVFILE="/dev/shm/sem.ADBE_*"
-+ALLOWDEVFILE=/dev/shm/pulse-shm-*
-+ALLOWDEVFILE=/dev/md/md-device-map
-+# tomboy creates this one
-+ALLOWDEVFILE="/dev/shm/mono.*"
-+# created by libv4l
-+ALLOWDEVFILE="/dev/shm/libv4l-*"
-+# created by spice video
-+ALLOWDEVFILE="/dev/shm/spice.*"
-+# created by mdadm
-+ALLOWDEVFILE="/dev/md/autorebuild.pid"
- 
- #
- # This setting tells rkhunter where the inetd configuration
-@@ -724,6 +781,7 @@
- # The option may be specified more than once.
- #
- #SUSPSCAN_DIRS="/tmp /var/tmp"
-+SUSPSCAN_DIRS="/tmp /var/tmp"
- 
- #
- # Directory for temporary files. A memory-based one is better (faster).
-@@ -822,7 +880,9 @@
- #
- #RTKT_DIR_WHITELIST=""
- #RTKT_FILE_WHITELIST=""
--
-+RTKT_FILE_WHITELIST=/bin/ad
-+# FreeIPA Certificate Authority
-+RTKT_FILE_WHITELIST=/var/log/pki-ca/system
- #
- # The following option can be used to whitelist shared library files that would
- # normally be flagged with a warning during the preloaded shared library check.
-@@ -980,3 +1040,5 @@
- # both programs, then disable the 'hidden_procs' test.
- #
- #DISABLE_UNHIDE=0
-+
-+INSTALLDIR="/usr"
diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch
new file mode 100644
index 0000000..d6e6f07
--- /dev/null
+++ b/rkhunter-1.4.2-fedoraconfig.patch
@@ -0,0 +1,186 @@
+diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf
+--- rkhunter-1.4.2.orig/files/rkhunter.conf	2014-02-23 19:38:01.000000000 -0700
++++ rkhunter-1.4.2/files/rkhunter.conf	2014-03-05 17:23:47.171809385 -0700
+@@ -155,6 +155,7 @@
+ # default directory beneath the installation directory.
+ #
+ #TMPDIR=/var/lib/rkhunter/tmp
++TMPDIR=/var/lib/rkhunter
+ 
+ #
+ # This option specifies the database directory to use.
+@@ -163,7 +164,7 @@
+ # subsequently commented out or removed, then the program will assume a
+ # default directory beneath the installation directory.
+ #
+-#DBDIR=/var/lib/rkhunter/db
++DBDIR=/var/lib/rkhunter/db
+ 
+ #
+ # This option specifies the script directory to use.
+@@ -172,6 +173,7 @@
+ # subsequently commented out or removed, then the program will not run.
+ #
+ #SCRIPTDIR=/usr/local/lib/rkhunter/scripts
++SCRIPTDIR=/usr/share/rkhunter/scripts
+ 
+ #
+ # This option can be used to modify the command directory list used by rkhunter
+@@ -228,7 +230,7 @@
+ #
+ # The default value is '/var/log/rkhunter.log'.
+ #
+-LOGFILE=/var/log/rkhunter.log
++LOGFILE=/var/log/rkhunter/rkhunter.log
+ 
+ #
+ # Set this option to '1' if the log file is to be appended to whenever rkhunter
+@@ -238,6 +240,7 @@
+ # The default value is '0'.
+ #
+ #APPEND_LOG=0
++APPEND_LOG=1
+ 
+ #
+ # Set the following option to '1' if the log file is to be copied when rkhunter
+@@ -304,6 +307,7 @@
+ # The default value is 'no'.
+ #
+ #ALLOW_SSH_ROOT_USER=no
++ALLOW_SSH_ROOT_USER=unset
+ 
+ #
+ # Set this option to '1' to allow the use of the SSH-1 protocol, but note
+@@ -318,6 +322,7 @@
+ # The default value is '0'.
+ #
+ #ALLOW_SSH_PROT_V1=0
++ALLOW_SSH_PROT_V1=2
+ 
+ #
+ # This setting tells rkhunter the directory containing the SSH configuration
+@@ -350,7 +355,8 @@
+ # program defaults.
+ #
+ ENABLE_TESTS=ALL
+-DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps
++#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps
++DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps
+ 
+ #
+ # The HASH_CMD option can be used to specify the command to use for the file
+@@ -422,6 +428,7 @@
+ # Also see the PKGMGR_NO_VRFY and USE_SUNSUM options.
+ #
+ #PKGMGR=NONE
++PKGMGR=RPM
+ 
+ #
+ # It is possible that a file, which is part of a package, may have been
+@@ -545,6 +552,9 @@
+ # The default value is the null string.
+ #
+ #EXISTWHITELIST=""
++EXISTWHITELIST=/bin/ad
++# FreeIPA Certificate Authority
++EXISTWHITELIST=/var/log/pki-ca/system
+ 
+ #
+ # Whitelist various attributes of the specified file. The attributes are those
+@@ -575,6 +585,12 @@
+ # The default value is the null string.
+ #
+ #SCRIPTWHITELIST=/usr/bin/groups
++SCRIPTWHITELIST=/usr/bin/whatis
++SCRIPTWHITELIST=/usr/bin/ldd
++SCRIPTWHITELIST=/usr/bin/groups
++SCRIPTWHITELIST=/usr/bin/GET
++SCRIPTWHITELIST=/sbin/ifup
++SCRIPTWHITELIST=/sbin/ifdown
+ 
+ #
+ # Allow the specified file to have the immutable attribute set.
+@@ -605,6 +621,19 @@
+ #ALLOWHIDDENDIR=/dev/.udev
+ #ALLOWHIDDENDIR=/dev/.udevdb
+ #ALLOWHIDDENDIR=/dev/.mdadm
++ALLOWHIDDENDIR="/etc/.java"
++ALLOWHIDDENDIR=/dev/.udev
++ALLOWHIDDENDIR=/dev/.udevdb
++ALLOWHIDDENDIR=/dev/.udev.tdb
++ALLOWHIDDENDIR=/dev/.static
++ALLOWHIDDENDIR=/dev/.initramfs
++ALLOWHIDDENDIR=/dev/.SRC-unix
++ALLOWHIDDENDIR=/dev/.mdadm
++ALLOWHIDDENDIR=/dev/.systemd
++ALLOWHIDDENDIR=/dev/.mount
++# for etckeeper
++ALLOWHIDDENDIR=/etc/.git
++ALLOWHIDDENDIR=/etc/.bzr
+ 
+ #
+ # Allow the specified hidden file to be whitelisted.
+@@ -620,6 +649,30 @@
+ #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
+ #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
+ #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
++ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz"
++ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac
++ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac
++ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-keygen.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-keyscan.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-add.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-agent.hmac
++ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.*.hmac
++ALLOWHIDDENFILE=/usr/lib*/.libgcrypt.so.*.hmac
++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha1hmac.hmac
++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha256hmac.hmac
++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha384hmac.hmac
++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha512hmac.hmac
++ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
++ALLOWHIDDENFILE=/dev/.mdadm.map
++ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz
++ALLOWHIDDENFILE=/usr/share/man/man5/.k5identity.5.gz
++ALLOWHIDDENFILE=/usr/sbin/.ipsec.hmac
++# etckeeper
++ALLOWHIDDENFILE=/etc/.etckeeper
++ALLOWHIDDENFILE=/etc/.gitignore
++ALLOWHIDDENFILE=/etc/.bzrignore
+ 
+ #
+ # Allow the specified process to use deleted files. The process name may be
+@@ -681,6 +734,16 @@
+ #
+ #ALLOWDEVFILE=/dev/shm/pulse-shm-*
+ #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
++ALLOWDEVFILE=/dev/shm/pulse-shm-*
++ALLOWDEVFILE=/dev/md/md-device-map
++# tomboy creates this one
++ALLOWDEVFILE="/dev/shm/mono.*"
++# created by libv4l
++ALLOWDEVFILE="/dev/shm/libv4l-*"
++# created by spice video
++ALLOWDEVFILE="/dev/shm/spice.*"
++# created by mdadm
++ALLOWDEVFILE="/dev/md/autorebuild.pid"
+ 
+ #
+ # This option is used to indicate if the Phalanx2 test is to perform a basic
+@@ -1004,6 +1067,9 @@
+ #
+ #RTKT_DIR_WHITELIST=""
+ #RTKT_FILE_WHITELIST=""
++RTKT_FILE_WHITELIST=/bin/ad
++# FreeIPA Certificate Authority
++RTKT_FILE_WHITELIST=/var/log/pki-ca/system
+ 
+ #
+ # The following option can be used to whitelist shared library files that would
+@@ -1222,3 +1288,5 @@
+ #
+ #EMPTY_LOGFILES=""
+ #MISSING_LOGFILES=""
++
++INSTALLDIR="/usr"
diff --git a/rkhunter.spec b/rkhunter.spec
index 9742e40..f322617 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -2,8 +2,8 @@
 %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
 
 Name:           rkhunter
-Version:        1.4.0
-Release:        9%{?dist}
+Version:        1.4.2
+Release:        1%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -12,10 +12,7 @@ URL:            http://rkhunter.sourceforge.net/
 Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
-Patch0:         rkhunter-1.4.0-fedoraconfig.patch
-# Patch to help with spaces in allow dev file. 
-# https://bugzilla.redhat.com/show_bug.cgi?id=984180
-Patch1:         rkhunter-1.4.0-allowdevfile-space.patch
+Patch0:         rkhunter-1.4.2-fedoraconfig.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -35,8 +32,6 @@ and other unwanted tools.
 
 %patch0 -p1
 
-%patch1 -p1
-
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}/%{name}.log {
     weekly
@@ -104,6 +99,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Mar 14 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-1
+- Update to 1.4.2
+
 * Sun Sep 01 2013 Kevin Fenzi <kevin@scrye.com> 1.4.0-9
 - Add patch for now to help spaces in allowdev file handling. Fixes bug #984180
 
diff --git a/sources b/sources
index 01cf4f6..873ec5b 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-37b1ceb79a5ff3debca335d6550ac6b0  rkhunter-1.4.0.tar.gz
+85ad366b7f3999eb2a9371e39a1a4df7  rkhunter-1.4.2.tar.gz

From 17b3bec11261a65e30d5c9cb98239663feff117a Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sun, 6 Apr 2014 11:53:08 -0600
Subject: [PATCH 069/122] Add patch to fix ipcs command in non en locales

- Add config to fix freeipa installs. Fixes bug #994567
---
 rkhunter-1.4.2-fedoraconfig.patch | 27 ++++++++++++++++++---------
 rkhunter-1.4.2-ipcs-locale.patch  | 18 ++++++++++++++++++
 rkhunter.spec                     | 13 +++++++++++--
 3 files changed, 47 insertions(+), 11 deletions(-)
 create mode 100644 rkhunter-1.4.2-ipcs-locale.patch

diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch
index d6e6f07..2117d1b 100644
--- a/rkhunter-1.4.2-fedoraconfig.patch
+++ b/rkhunter-1.4.2-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf
---- rkhunter-1.4.2.orig/files/rkhunter.conf	2014-02-23 19:38:01.000000000 -0700
-+++ rkhunter-1.4.2/files/rkhunter.conf	2014-03-05 17:23:47.171809385 -0700
+--- rkhunter-1.4.2.orig/files/rkhunter.conf	2014-01-25 14:29:51.000000000 -0700
++++ rkhunter-1.4.2/files/rkhunter.conf	2014-04-06 11:43:15.719800756 -0600
 @@ -155,6 +155,7 @@
  # default directory beneath the installation directory.
  #
@@ -77,17 +77,22 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # It is possible that a file, which is part of a package, may have been
-@@ -545,6 +552,9 @@
+@@ -545,6 +552,14 @@
  # The default value is the null string.
  #
  #EXISTWHITELIST=""
 +EXISTWHITELIST=/bin/ad
 +# FreeIPA Certificate Authority
 +EXISTWHITELIST=/var/log/pki-ca/system
++# FreeIPA Certificate Authority
++EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system
++# Some non default installed files we check
++EXISTWHITELIST=/usr/bin/GET
++EXISTWHITELIST=/usr/bin/whatis
  
  #
  # Whitelist various attributes of the specified file. The attributes are those
-@@ -575,6 +585,12 @@
+@@ -575,6 +590,12 @@
  # The default value is the null string.
  #
  #SCRIPTWHITELIST=/usr/bin/groups
@@ -100,7 +105,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Allow the specified file to have the immutable attribute set.
-@@ -605,6 +621,19 @@
+@@ -605,6 +626,19 @@
  #ALLOWHIDDENDIR=/dev/.udev
  #ALLOWHIDDENDIR=/dev/.udevdb
  #ALLOWHIDDENDIR=/dev/.mdadm
@@ -120,7 +125,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -620,6 +649,30 @@
+@@ -620,6 +654,30 @@
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
  #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
@@ -151,7 +156,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -681,6 +734,16 @@
+@@ -681,6 +739,18 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -165,20 +170,24 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
 +ALLOWDEVFILE="/dev/shm/spice.*"
 +# created by mdadm
 +ALLOWDEVFILE="/dev/md/autorebuild.pid"
++# 389 Directory Server
++ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats
  
  #
  # This option is used to indicate if the Phalanx2 test is to perform a basic
-@@ -1004,6 +1067,9 @@
+@@ -1004,6 +1074,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
 +RTKT_FILE_WHITELIST=/bin/ad
 +# FreeIPA Certificate Authority
 +RTKT_FILE_WHITELIST=/var/log/pki-ca/system
++# FreeIPA Certificate Authority
++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/ca/system
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1222,3 +1288,5 @@
+@@ -1222,3 +1297,5 @@
  #
  #EMPTY_LOGFILES=""
  #MISSING_LOGFILES=""
diff --git a/rkhunter-1.4.2-ipcs-locale.patch b/rkhunter-1.4.2-ipcs-locale.patch
new file mode 100644
index 0000000..0457e4c
--- /dev/null
+++ b/rkhunter-1.4.2-ipcs-locale.patch
@@ -0,0 +1,18 @@
+diff -Nur rkhunter-1.4.2.orig/files/rkhunter rkhunter-1.4.2/files/rkhunter
+--- rkhunter-1.4.2.orig/files/rkhunter	2014-03-12 14:54:55.000000000 -0600
++++ rkhunter-1.4.2/files/rkhunter	2014-04-06 11:39:44.776583858 -0600
+@@ -13964,11 +13964,11 @@
+                         touch "${IPCS_TMPFILE}"
+                         FOUND=0; echo $FOUND > "${IPCS_TMPFILE}"
+ 
+-                        if [ `${IPCS_CMD} -u 2>/dev/null | awk -F' ' '/segments allocated/ {print $3}'` -ne 0 ]; then
+-                                ${IPCS_CMD} -m | grep "^0x" | while read RKH_SHM_KEY RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_PERMS RKH_SHM_BYTES RKH_SHM_NATTACH RKH_SHM_STATUS; do
++                        if [ `LC_ALL=C ${IPCS_CMD} -u 2>/dev/null | awk -F' ' '/segments allocated/ {print $3}'` -ne 0 ]; then
++                                LC_ALL=C ${IPCS_CMD} -m | grep "^0x" | while read RKH_SHM_KEY RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_PERMS RKH_SHM_BYTES RKH_SHM_NATTACH RKH_SHM_STATUS; do
+                                         if [ $RKH_SHM_PERMS -eq 666 -a $RKH_SHM_BYTES -ge 1000000 ]; then
+                                                 FOUND=1; echo $FOUND > "${IPCS_TMPFILE}"
+-                                                ${IPCS_CMD} -p | grep "^${RKH_SHM_SHMID}" | while read RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_CPID RKH_SHM_LPID; do
++                                                LC_ALL=C ${IPCS_CMD} -p | grep "^${RKH_SHM_SHMID}" | while read RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_CPID RKH_SHM_LPID; do
+                                                         RKH_SHM_PATH=`${READLINK_CMD} -f /proc/${RKH_SHM_CPID}/exe`
+                                                         if [ $VERBOSE_LOGGING -eq 1 ]; then
+                                                                 display --to LOG --type PLAIN --result FOUND --log-indent 2 ROOTKIT_MALWARE_IPCS_DETAILS "${RKH_SHM_PATH}" "${RKH_SHM_CPID}" "${RKH_SHM_OWNER}"
diff --git a/rkhunter.spec b/rkhunter.spec
index f322617..e4a1e6e 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -13,6 +13,10 @@ Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.ta
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
 Patch0:         rkhunter-1.4.2-fedoraconfig.patch
+#
+# Fix issue with ipcs command and locales
+#
+Patch1:         rkhunter-1.4.2-ipcs-locale.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -31,6 +35,7 @@ and other unwanted tools.
 %setup -q
 
 %patch0 -p1
+%patch1 -p1
 
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}/%{name}.log {
@@ -99,6 +104,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Apr 06 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-2
+- Add patch to fix ipcs command in non en locales
+- Add config to fix freeipa installs. Fixes bug #994567
+
 * Fri Mar 14 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-1
 - Update to 1.4.2
 
@@ -289,7 +298,7 @@ EOF
 - Changed to SHA1 for optional message digest (canary check)
 - Added a couple of suggested skip entries to rkhunter.conf
 
-* Mon Jun 11 2005 Greg Houlette <tamaster@pobox.com> - 1.2.7-1
+* Sat Jun 11 2005 Greg Houlette <tamaster@pobox.com> - 1.2.7-1
 - Added signature auto-updating to CRON scan (new script)
 - Removed BOOTSCAN pending rewrite to full SysV Init scan in background
 - Added the --append-log command line option

From 0396062a2fd45171014a6fa5b4ba036d04546f6a Mon Sep 17 00:00:00 2001
From: Dennis Gilmore <dennis@ausil.us>
Date: Sat, 7 Jun 2014 21:36:46 -0500
Subject: [PATCH 070/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index e4a1e6e..b956418 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -104,6 +104,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
 * Sun Apr 06 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-2
 - Add patch to fix ipcs command in non en locales
 - Add config to fix freeipa installs. Fixes bug #994567

From 750e7c26afe924940e76a862812d0c53b004dab2 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Fri, 26 Sep 2014 12:16:45 -0600
Subject: [PATCH 071/122] Fix cron script to work with non bash shells. Fixes
 bug #1146717

---
 01-rkhunter   | 2 +-
 rkhunter.spec | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/01-rkhunter b/01-rkhunter
index 6ff8877..1e85c8e 100755
--- a/01-rkhunter
+++ b/01-rkhunter
@@ -19,7 +19,7 @@ if [ ! -e /var/lock/subsys/rkhunter ]; then
   fi
 
   # If a diagnostic mode scan was requested, setup the parameters
-  if [ "$DIAG_SCAN" == "yes" ]; then
+  if [ "$DIAG_SCAN" = "yes" ]; then
     RKHUNTER_FLAGS="--checkall --skip-keypress --nocolors --quiet --appendlog --display-logfile"
   else
     RKHUNTER_FLAGS="--cronjob --nocolors --report-warnings-only"
diff --git a/rkhunter.spec b/rkhunter.spec
index b956418..a229e8a 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -104,6 +104,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Sep 26 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-4
+- Fix cron script to work with non bash shells. Fixes bug #1146717
+
 * Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.2-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
 

From eff4162c7d39be0bce4ee7d70c2954795ac03dc7 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Mon, 27 Oct 2014 09:42:30 -0600
Subject: [PATCH 072/122] Set /var/lib/rkhunter to be mode 700. fixes bug
 #1154428

---
 rkhunter.spec | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index a229e8a..af060e0 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -56,6 +56,7 @@ EOF
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8
+%{__mkdir} -m700 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/log/%{name}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n
@@ -104,6 +105,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Mon Oct 27 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-5
+- Set /var/lib/rkhunter to be mode 700. fixes bug #1154428
+
 * Fri Sep 26 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-4
 - Fix cron script to work with non bash shells. Fixes bug #1146717
 

From ccad0c6353f09448edd2d7acb7a8f545095bbef0 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 20 Dec 2014 09:13:26 -0700
Subject: [PATCH 073/122] =?UTF-8?q?-=20Add=20/etc/.updated=20systemd=20fil?=
 =?UTF-8?q?e=20to=20whitelist.=20Fixes=20bug=20#1173481=20-=20Add=20patch?=
 =?UTF-8?q?=20to=20fix=20grep=20-a=20issue=20with=20too=20many=20arguments?=
 =?UTF-8?q?=20output.=C2=B7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 rkhunter-1.4.2-fedoraconfig.patch | 12 +++++++-----
 rkhunter-1.4.2-grepopt.patch      | 11 +++++++++++
 rkhunter.spec                     | 11 ++++++++++-
 3 files changed, 28 insertions(+), 6 deletions(-)
 create mode 100644 rkhunter-1.4.2-grepopt.patch

diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch
index 2117d1b..8c06708 100644
--- a/rkhunter-1.4.2-fedoraconfig.patch
+++ b/rkhunter-1.4.2-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf
 --- rkhunter-1.4.2.orig/files/rkhunter.conf	2014-01-25 14:29:51.000000000 -0700
-+++ rkhunter-1.4.2/files/rkhunter.conf	2014-04-06 11:43:15.719800756 -0600
++++ rkhunter-1.4.2/files/rkhunter.conf	2014-12-20 09:06:10.548766864 -0700
 @@ -155,6 +155,7 @@
  # default directory beneath the installation directory.
  #
@@ -125,7 +125,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -620,6 +654,30 @@
+@@ -620,6 +654,32 @@
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
  #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
@@ -153,10 +153,12 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
 +ALLOWHIDDENFILE=/etc/.etckeeper
 +ALLOWHIDDENFILE=/etc/.gitignore
 +ALLOWHIDDENFILE=/etc/.bzrignore
++# systemd
++ALLOWHIDDENFILE=/etc/.updated
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -681,6 +739,18 @@
+@@ -681,6 +741,18 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -175,7 +177,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # This option is used to indicate if the Phalanx2 test is to perform a basic
-@@ -1004,6 +1074,11 @@
+@@ -1004,6 +1076,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -187,7 +189,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1222,3 +1297,5 @@
+@@ -1222,3 +1299,5 @@
  #
  #EMPTY_LOGFILES=""
  #MISSING_LOGFILES=""
diff --git a/rkhunter-1.4.2-grepopt.patch b/rkhunter-1.4.2-grepopt.patch
new file mode 100644
index 0000000..6f1f6fb
--- /dev/null
+++ b/rkhunter-1.4.2-grepopt.patch
@@ -0,0 +1,11 @@
+diff -Nur rkhunter-1.4.2.orig/files/rkhunter rkhunter-1.4.2/files/rkhunter
+--- rkhunter-1.4.2.orig/files/rkhunter	2014-12-20 09:07:54.826773450 -0700
++++ rkhunter-1.4.2/files/rkhunter	2014-12-20 09:08:45.739800180 -0700
+@@ -18480,6 +18480,7 @@
+ case "${OPERATING_SYSTEM}" in
+ Linux)
+ 	LINUXOS=1
++	GREP_OPT="-a"
+ 	;;
+ *BSD|DragonFly)
+ 	BSDOS=1
diff --git a/rkhunter.spec b/rkhunter.spec
index af060e0..8ae8076 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -17,6 +17,10 @@ Patch0:         rkhunter-1.4.2-fedoraconfig.patch
 # Fix issue with ipcs command and locales
 #
 Patch1:         rkhunter-1.4.2-ipcs-locale.patch
+#
+# Fix grep -a issue 
+#
+Patch2:         rkhunter-1.4.2-grepopt.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -36,6 +40,7 @@ and other unwanted tools.
 
 %patch0 -p1
 %patch1 -p1
+%patch2 -p1
 
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}/%{name}.log {
@@ -105,6 +110,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Dec 20 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-6
+- Add /etc/.updated systemd file to whitelist. Fixes bug #1173481
+- Add patch to fix grep -a issue with too many arguments output. 
+
 * Mon Oct 27 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-5
 - Set /var/lib/rkhunter to be mode 700. fixes bug #1154428
 

From ad2d3480decc5c86fd43eadee633a0b4a86b543a Mon Sep 17 00:00:00 2001
From: Dennis Gilmore <dennis@ausil.us>
Date: Thu, 18 Jun 2015 22:24:48 +0000
Subject: [PATCH 074/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 8ae8076..598dcff 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        6%{?dist}
+Release:        7%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -110,6 +110,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Thu Jun 18 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.2-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
 * Sat Dec 20 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-6
 - Add /etc/.updated systemd file to whitelist. Fixes bug #1173481
 - Add patch to fix grep -a issue with too many arguments output. 

From 459190292ea13f683a72102740ab05adf32e7c8f Mon Sep 17 00:00:00 2001
From: Mukundan Ragavan <nonamedotc@gmail.com>
Date: Tue, 13 Oct 2015 20:17:51 -0400
Subject: [PATCH 075/122] Change config patch to account for change in default
 SSH config

---
 rkhunter-1.4.2-fedoraconfig.patch | 2 +-
 rkhunter.spec                     | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch
index 8c06708..1aff04a 100644
--- a/rkhunter-1.4.2-fedoraconfig.patch
+++ b/rkhunter-1.4.2-fedoraconfig.patch
@@ -47,7 +47,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  # The default value is 'no'.
  #
  #ALLOW_SSH_ROOT_USER=no
-+ALLOW_SSH_ROOT_USER=unset
++ALLOW_SSH_ROOT_USER=yes
  
  #
  # Set this option to '1' to allow the use of the SSH-1 protocol, but note
diff --git a/rkhunter.spec b/rkhunter.spec
index 598dcff..1771b99 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -110,6 +110,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Tue Oct 13 2015 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-8
+- Change config patch to account for change in default SSH config
+
 * Thu Jun 18 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.2-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
 

From 54e01c542bc3672f30eed07d215ebbd11ea05741 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sun, 6 Dec 2015 11:23:29 -0700
Subject: [PATCH 076/122] Add /dev/shm/squid files to whitelist. Fixes bug
 #1279632

---
 rkhunter-1.4.2-fedoraconfig.patch | 10 ++++++----
 rkhunter.spec                     |  5 ++++-
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch
index 1aff04a..3df13ef 100644
--- a/rkhunter-1.4.2-fedoraconfig.patch
+++ b/rkhunter-1.4.2-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf
 --- rkhunter-1.4.2.orig/files/rkhunter.conf	2014-01-25 14:29:51.000000000 -0700
-+++ rkhunter-1.4.2/files/rkhunter.conf	2014-12-20 09:06:10.548766864 -0700
++++ rkhunter-1.4.2/files/rkhunter.conf	2015-12-06 11:19:26.840917848 -0700
 @@ -155,6 +155,7 @@
  # default directory beneath the installation directory.
  #
@@ -158,7 +158,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -681,6 +741,18 @@
+@@ -681,6 +741,20 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -174,10 +174,12 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
 +ALLOWDEVFILE="/dev/md/autorebuild.pid"
 +# 389 Directory Server
 +ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats
++# squid proxy
++ALLOWDEVFILE=/dev/shm/squid-cf*
  
  #
  # This option is used to indicate if the Phalanx2 test is to perform a basic
-@@ -1004,6 +1076,11 @@
+@@ -1004,6 +1078,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -189,7 +191,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1222,3 +1299,5 @@
+@@ -1222,3 +1301,5 @@
  #
  #EMPTY_LOGFILES=""
  #MISSING_LOGFILES=""
diff --git a/rkhunter.spec b/rkhunter.spec
index 1771b99..5ffb7c7 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        8%{?dist}
+Release:        9%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -110,6 +110,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Dec 06 2015 Kevin Fenzi <kevin@scrye.com> - 1.4.2-9
+- Add /dev/shm/squid files to whitelist. Fixes bug #1279632
+
 * Tue Oct 13 2015 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-8
 - Change config patch to account for change in default SSH config
 

From 8e4da676d12c3706862f807fd83beae0421004c1 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 4 Feb 2016 22:12:52 +0000
Subject: [PATCH 077/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 5ffb7c7..a9a647b 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        9%{?dist}
+Release:        10%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -110,6 +110,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.2-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
 * Sun Dec 06 2015 Kevin Fenzi <kevin@scrye.com> - 1.4.2-9
 - Add /dev/shm/squid files to whitelist. Fixes bug #1279632
 

From a1a79a3b7e493700e4ad72967877ddce4be5a2e8 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Wed, 20 Apr 2016 09:56:26 -0600
Subject: [PATCH 078/122] Add /dev/shm/lldpad files to whitelist. Fixes bug
 #1293059

---
 rkhunter-1.4.2-fedoraconfig.patch | 10 ++++++----
 rkhunter.spec                     |  5 ++++-
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch
index 3df13ef..e3fa72d 100644
--- a/rkhunter-1.4.2-fedoraconfig.patch
+++ b/rkhunter-1.4.2-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf
 --- rkhunter-1.4.2.orig/files/rkhunter.conf	2014-01-25 14:29:51.000000000 -0700
-+++ rkhunter-1.4.2/files/rkhunter.conf	2015-12-06 11:19:26.840917848 -0700
++++ rkhunter-1.4.2/files/rkhunter.conf	2016-04-20 09:43:32.059538092 -0600
 @@ -155,6 +155,7 @@
  # default directory beneath the installation directory.
  #
@@ -158,7 +158,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -681,6 +741,20 @@
+@@ -681,6 +741,22 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -176,10 +176,12 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
 +ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats
 +# squid proxy
 +ALLOWDEVFILE=/dev/shm/squid-cf*
++# allow lldpad state file
++ALLOWDEVFILE=/dev/shm/lldpad.state
  
  #
  # This option is used to indicate if the Phalanx2 test is to perform a basic
-@@ -1004,6 +1078,11 @@
+@@ -1004,6 +1080,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -191,7 +193,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1222,3 +1301,5 @@
+@@ -1222,3 +1303,5 @@
  #
  #EMPTY_LOGFILES=""
  #MISSING_LOGFILES=""
diff --git a/rkhunter.spec b/rkhunter.spec
index a9a647b..fd417b0 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        10%{?dist}
+Release:        11%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -110,6 +110,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Apr 20 2016 Kevin Fenzi <kevin@scrye.com> - 1.4.2-11
+- Add /dev/shm/lldpad files to whitelist. Fixes bug #1293059
+
 * Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.2-10
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
 

From d52773e606044a1875b820d90315204b240499e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Fri, 24 Jun 2016 10:20:10 +0200
Subject: [PATCH 079/122] Mandatory Perl build-requires added
 <https://fedoraproject.org/wiki/Changes/Build_Root_Without_Perl>

---
 rkhunter.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rkhunter.spec b/rkhunter.spec
index fd417b0..3a88ef4 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -23,6 +23,7 @@ Patch1:         rkhunter-1.4.2-ipcs-locale.patch
 Patch2:         rkhunter-1.4.2-grepopt.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+BuildRequires:      perl-generators
 
 Requires:       coreutils, binutils, kmod, findutils, grep
 Requires:       e2fsprogs, procps, lsof, iproute, wget

From a9f29504934919cedf2df6b864a51f6e1e594648 Mon Sep 17 00:00:00 2001
From: Mukundan Ragavan <nonamedotc@gmail.com>
Date: Wed, 25 Jan 2017 21:11:04 -0500
Subject: [PATCH 080/122] Add /dev/shm/qb* files to whitelist. Fixes bug
 #1403602 Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug
 #1411130

---
 rkhunter-1.4.2-fedoraconfig.patch | 28 +++++++++++++++++++++-------
 rkhunter.spec                     |  6 +++++-
 2 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.2-fedoraconfig.patch
index e3fa72d..9b86c3d 100644
--- a/rkhunter-1.4.2-fedoraconfig.patch
+++ b/rkhunter-1.4.2-fedoraconfig.patch
@@ -1,6 +1,5 @@
-diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf
---- rkhunter-1.4.2.orig/files/rkhunter.conf	2014-01-25 14:29:51.000000000 -0700
-+++ rkhunter-1.4.2/files/rkhunter.conf	2016-04-20 09:43:32.059538092 -0600
+--- rkhunter-1.4.2.orig/files/rkhunter.conf	2017-01-25 21:03:14.142522097 -0500
++++ rkhunter-1.4.2/files/rkhunter.conf	2017-01-25 21:05:50.114146953 -0500
 @@ -155,6 +155,7 @@
  # default directory beneath the installation directory.
  #
@@ -125,7 +124,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -620,6 +654,32 @@
+@@ -620,6 +654,45 @@
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
  #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
@@ -155,10 +154,23 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
 +ALLOWHIDDENFILE=/etc/.bzrignore
 +# systemd
 +ALLOWHIDDENFILE=/etc/.updated
++
++
++# Allow PCS/Pacemaker/Corosync
++ALLOWDEVFILE=/dev/shm/qb-attrd-*
++ALLOWDEVFILE=/dev/shm/qb-cfg-*
++ALLOWDEVFILE=/dev/shm/qb-cib_rw-*
++ALLOWDEVFILE=/dev/shm/qb-cib_shm-*
++ALLOWDEVFILE=/dev/shm/qb-corosync-*
++ALLOWDEVFILE=/dev/shm/qb-cpg-*
++ALLOWDEVFILE=/dev/shm/qb-lrmd-*
++ALLOWDEVFILE=/dev/shm/qb-pengine-*
++ALLOWDEVFILE=/dev/shm/qb-quorum-*
++ALLOWDEVFILE=/dev/shm/qb-stonith-*
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -681,6 +741,22 @@
+@@ -681,6 +754,24 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -176,12 +188,14 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
 +ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats
 +# squid proxy
 +ALLOWDEVFILE=/dev/shm/squid-cf*
++# squid ssl cache
++ALLOWDEVFILE=/dev/shm/squid-ssl_session_cache.shm
 +# allow lldpad state file
 +ALLOWDEVFILE=/dev/shm/lldpad.state
  
  #
  # This option is used to indicate if the Phalanx2 test is to perform a basic
-@@ -1004,6 +1080,11 @@
+@@ -1004,6 +1095,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -193,7 +207,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1222,3 +1303,5 @@
+@@ -1222,3 +1318,5 @@
  #
  #EMPTY_LOGFILES=""
  #MISSING_LOGFILES=""
diff --git a/rkhunter.spec b/rkhunter.spec
index 3a88ef4..c127f6c 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        11%{?dist}
+Release:        12%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -111,6 +111,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Jan 25 2017 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-12
+- Add /dev/shm/qb* files to whitelist. Fixes bug #1403602
+- Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug #1411130
+
 * Wed Apr 20 2016 Kevin Fenzi <kevin@scrye.com> - 1.4.2-11
 - Add /dev/shm/lldpad files to whitelist. Fixes bug #1293059
 

From 1abde9b791a8482a530e30d559fdd32d6d533c5c Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 11 Feb 2017 11:46:04 +0000
Subject: [PATCH 081/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index c127f6c..a1a2ce8 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.2
-Release:        12%{?dist}
+Release:        13%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -111,6 +111,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.2-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
 * Wed Jan 25 2017 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-12
 - Add /dev/shm/qb* files to whitelist. Fixes bug #1403602
 - Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug #1411130

From 6a0737b2c494a7bf39fb62864f490d2308b51aee Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Fri, 30 Jun 2017 15:06:00 -0600
Subject: [PATCH 082/122] - Update to 1.4.4. Fixes bug #1466318 - Fix for
 logger and spaces. Fixes bug #1284403

---
 .gitignore                                    |  1 +
 rkhunter-1.4.2-grepopt.patch                  | 11 ---
 rkhunter-1.4.2-ipcs-locale.patch              | 18 -----
 ...patch => rkhunter-1.4.4-fedoraconfig.patch | 74 +++++++++----------
 rkhunter.spec                                 | 25 ++-----
 sources                                       |  2 +-
 6 files changed, 46 insertions(+), 85 deletions(-)
 delete mode 100644 rkhunter-1.4.2-grepopt.patch
 delete mode 100644 rkhunter-1.4.2-ipcs-locale.patch
 rename rkhunter-1.4.2-fedoraconfig.patch => rkhunter-1.4.4-fedoraconfig.patch (88%)

diff --git a/.gitignore b/.gitignore
index 8ffe1c8..1422757 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@ rkhunter-1.3.6.tar.gz
 /rkhunter-1.3.8.tar.gz
 /rkhunter-1.4.0.tar.gz
 /rkhunter-1.4.2.tar.gz
+/rkhunter-1.4.4.tar.gz
diff --git a/rkhunter-1.4.2-grepopt.patch b/rkhunter-1.4.2-grepopt.patch
deleted file mode 100644
index 6f1f6fb..0000000
--- a/rkhunter-1.4.2-grepopt.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-diff -Nur rkhunter-1.4.2.orig/files/rkhunter rkhunter-1.4.2/files/rkhunter
---- rkhunter-1.4.2.orig/files/rkhunter	2014-12-20 09:07:54.826773450 -0700
-+++ rkhunter-1.4.2/files/rkhunter	2014-12-20 09:08:45.739800180 -0700
-@@ -18480,6 +18480,7 @@
- case "${OPERATING_SYSTEM}" in
- Linux)
- 	LINUXOS=1
-+	GREP_OPT="-a"
- 	;;
- *BSD|DragonFly)
- 	BSDOS=1
diff --git a/rkhunter-1.4.2-ipcs-locale.patch b/rkhunter-1.4.2-ipcs-locale.patch
deleted file mode 100644
index 0457e4c..0000000
--- a/rkhunter-1.4.2-ipcs-locale.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-diff -Nur rkhunter-1.4.2.orig/files/rkhunter rkhunter-1.4.2/files/rkhunter
---- rkhunter-1.4.2.orig/files/rkhunter	2014-03-12 14:54:55.000000000 -0600
-+++ rkhunter-1.4.2/files/rkhunter	2014-04-06 11:39:44.776583858 -0600
-@@ -13964,11 +13964,11 @@
-                         touch "${IPCS_TMPFILE}"
-                         FOUND=0; echo $FOUND > "${IPCS_TMPFILE}"
- 
--                        if [ `${IPCS_CMD} -u 2>/dev/null | awk -F' ' '/segments allocated/ {print $3}'` -ne 0 ]; then
--                                ${IPCS_CMD} -m | grep "^0x" | while read RKH_SHM_KEY RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_PERMS RKH_SHM_BYTES RKH_SHM_NATTACH RKH_SHM_STATUS; do
-+                        if [ `LC_ALL=C ${IPCS_CMD} -u 2>/dev/null | awk -F' ' '/segments allocated/ {print $3}'` -ne 0 ]; then
-+                                LC_ALL=C ${IPCS_CMD} -m | grep "^0x" | while read RKH_SHM_KEY RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_PERMS RKH_SHM_BYTES RKH_SHM_NATTACH RKH_SHM_STATUS; do
-                                         if [ $RKH_SHM_PERMS -eq 666 -a $RKH_SHM_BYTES -ge 1000000 ]; then
-                                                 FOUND=1; echo $FOUND > "${IPCS_TMPFILE}"
--                                                ${IPCS_CMD} -p | grep "^${RKH_SHM_SHMID}" | while read RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_CPID RKH_SHM_LPID; do
-+                                                LC_ALL=C ${IPCS_CMD} -p | grep "^${RKH_SHM_SHMID}" | while read RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_CPID RKH_SHM_LPID; do
-                                                         RKH_SHM_PATH=`${READLINK_CMD} -f /proc/${RKH_SHM_CPID}/exe`
-                                                         if [ $VERBOSE_LOGGING -eq 1 ]; then
-                                                                 display --to LOG --type PLAIN --result FOUND --log-indent 2 ROOTKIT_MALWARE_IPCS_DETAILS "${RKH_SHM_PATH}" "${RKH_SHM_CPID}" "${RKH_SHM_OWNER}"
diff --git a/rkhunter-1.4.2-fedoraconfig.patch b/rkhunter-1.4.4-fedoraconfig.patch
similarity index 88%
rename from rkhunter-1.4.2-fedoraconfig.patch
rename to rkhunter-1.4.4-fedoraconfig.patch
index 9b86c3d..ca26113 100644
--- a/rkhunter-1.4.2-fedoraconfig.patch
+++ b/rkhunter-1.4.4-fedoraconfig.patch
@@ -1,6 +1,7 @@
---- rkhunter-1.4.2.orig/files/rkhunter.conf	2017-01-25 21:03:14.142522097 -0500
-+++ rkhunter-1.4.2/files/rkhunter.conf	2017-01-25 21:05:50.114146953 -0500
-@@ -155,6 +155,7 @@
+diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.conf
+--- rkhunter-1.4.4.orig/files/rkhunter.conf	2017-06-22 18:19:20.000000000 -0600
++++ rkhunter-1.4.4/files/rkhunter.conf	2017-06-30 14:45:05.104227416 -0600
+@@ -158,6 +158,7 @@
  # default directory beneath the installation directory.
  #
  #TMPDIR=/var/lib/rkhunter/tmp
@@ -8,16 +9,15 @@
  
  #
  # This option specifies the database directory to use.
-@@ -163,7 +164,7 @@
- # subsequently commented out or removed, then the program will assume a
+@@ -167,6 +168,7 @@
  # default directory beneath the installation directory.
  #
--#DBDIR=/var/lib/rkhunter/db
+ #DBDIR=/var/lib/rkhunter/db
 +DBDIR=/var/lib/rkhunter/db
  
  #
  # This option specifies the script directory to use.
-@@ -172,6 +173,7 @@
+@@ -175,6 +177,7 @@
  # subsequently commented out or removed, then the program will not run.
  #
  #SCRIPTDIR=/usr/local/lib/rkhunter/scripts
@@ -25,7 +25,7 @@
  
  #
  # This option can be used to modify the command directory list used by rkhunter
-@@ -228,7 +230,7 @@
+@@ -231,7 +234,7 @@
  #
  # The default value is '/var/log/rkhunter.log'.
  #
@@ -34,7 +34,7 @@
  
  #
  # Set this option to '1' if the log file is to be appended to whenever rkhunter
-@@ -238,6 +240,7 @@
+@@ -241,6 +244,7 @@
  # The default value is '0'.
  #
  #APPEND_LOG=0
@@ -42,7 +42,7 @@
  
  #
  # Set the following option to '1' if the log file is to be copied when rkhunter
-@@ -304,6 +307,7 @@
+@@ -307,6 +311,7 @@
  # The default value is 'no'.
  #
  #ALLOW_SSH_ROOT_USER=no
@@ -50,7 +50,7 @@
  
  #
  # Set this option to '1' to allow the use of the SSH-1 protocol, but note
-@@ -318,6 +322,7 @@
+@@ -321,6 +326,7 @@
  # The default value is '0'.
  #
  #ALLOW_SSH_PROT_V1=0
@@ -58,17 +58,17 @@
  
  #
  # This setting tells rkhunter the directory containing the SSH configuration
-@@ -350,7 +355,8 @@
+@@ -353,7 +359,8 @@
  # program defaults.
  #
  ENABLE_TESTS=ALL
--DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps
-+#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps
+-DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps
++#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps
 +DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps
  
  #
  # The HASH_CMD option can be used to specify the command to use for the file
-@@ -422,6 +428,7 @@
+@@ -434,6 +441,7 @@
  # Also see the PKGMGR_NO_VRFY and USE_SUNSUM options.
  #
  #PKGMGR=NONE
@@ -76,7 +76,7 @@
  
  #
  # It is possible that a file, which is part of a package, may have been
-@@ -545,6 +552,14 @@
+@@ -557,6 +565,14 @@
  # The default value is the null string.
  #
  #EXISTWHITELIST=""
@@ -91,7 +91,7 @@
  
  #
  # Whitelist various attributes of the specified file. The attributes are those
-@@ -575,6 +590,12 @@
+@@ -587,6 +603,12 @@
  # The default value is the null string.
  #
  #SCRIPTWHITELIST=/usr/bin/groups
@@ -104,7 +104,7 @@
  
  #
  # Allow the specified file to have the immutable attribute set.
-@@ -605,6 +626,19 @@
+@@ -617,6 +639,19 @@
  #ALLOWHIDDENDIR=/dev/.udev
  #ALLOWHIDDENDIR=/dev/.udevdb
  #ALLOWHIDDENDIR=/dev/.mdadm
@@ -124,7 +124,7 @@
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -620,6 +654,45 @@
+@@ -632,6 +667,32 @@
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
  #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
@@ -154,23 +154,10 @@
 +ALLOWHIDDENFILE=/etc/.bzrignore
 +# systemd
 +ALLOWHIDDENFILE=/etc/.updated
-+
-+
-+# Allow PCS/Pacemaker/Corosync
-+ALLOWDEVFILE=/dev/shm/qb-attrd-*
-+ALLOWDEVFILE=/dev/shm/qb-cfg-*
-+ALLOWDEVFILE=/dev/shm/qb-cib_rw-*
-+ALLOWDEVFILE=/dev/shm/qb-cib_shm-*
-+ALLOWDEVFILE=/dev/shm/qb-corosync-*
-+ALLOWDEVFILE=/dev/shm/qb-cpg-*
-+ALLOWDEVFILE=/dev/shm/qb-lrmd-*
-+ALLOWDEVFILE=/dev/shm/qb-pengine-*
-+ALLOWDEVFILE=/dev/shm/qb-quorum-*
-+ALLOWDEVFILE=/dev/shm/qb-stonith-*
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -681,6 +754,24 @@
+@@ -701,6 +762,35 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -192,10 +179,21 @@
 +ALLOWDEVFILE=/dev/shm/squid-ssl_session_cache.shm
 +# allow lldpad state file
 +ALLOWDEVFILE=/dev/shm/lldpad.state
++# Allow PCS/Pacemaker/Corosync
++ALLOWDEVFILE=/dev/shm/qb-attrd-*
++ALLOWDEVFILE=/dev/shm/qb-cfg-*
++ALLOWDEVFILE=/dev/shm/qb-cib_rw-*
++ALLOWDEVFILE=/dev/shm/qb-cib_shm-*
++ALLOWDEVFILE=/dev/shm/qb-corosync-*
++ALLOWDEVFILE=/dev/shm/qb-cpg-*
++ALLOWDEVFILE=/dev/shm/qb-lrmd-*
++ALLOWDEVFILE=/dev/shm/qb-pengine-*
++ALLOWDEVFILE=/dev/shm/qb-quorum-*
++ALLOWDEVFILE=/dev/shm/qb-stonith-*
  
  #
- # This option is used to indicate if the Phalanx2 test is to perform a basic
-@@ -1004,6 +1095,11 @@
+ # Allow the specified process pathnames to use shared memory segments.
+@@ -1035,6 +1125,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -207,9 +205,9 @@
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1222,3 +1318,5 @@
+@@ -1274,3 +1369,5 @@
+ # The default value is '0'.
  #
- #EMPTY_LOGFILES=""
- #MISSING_LOGFILES=""
+ #GLOBSTAR=0
 +
 +INSTALLDIR="/usr"
diff --git a/rkhunter.spec b/rkhunter.spec
index a1a2ce8..9b3d533 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -2,8 +2,8 @@
 %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
 
 Name:           rkhunter
-Version:        1.4.2
-Release:        13%{?dist}
+Version:        1.4.4
+Release:        1%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -12,17 +12,8 @@ URL:            http://rkhunter.sourceforge.net/
 Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
-Patch0:         rkhunter-1.4.2-fedoraconfig.patch
-#
-# Fix issue with ipcs command and locales
-#
-Patch1:         rkhunter-1.4.2-ipcs-locale.patch
-#
-# Fix grep -a issue 
-#
-Patch2:         rkhunter-1.4.2-grepopt.patch
+Patch0:         rkhunter-1.4.4-fedoraconfig.patch
 BuildArch:      noarch
-BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires:      perl-generators
 
 Requires:       coreutils, binutils, kmod, findutils, grep
@@ -37,11 +28,7 @@ and other unwanted tools.
 
 %prep
 
-%setup -q
-
-%patch0 -p1
-%patch1 -p1
-%patch2 -p1
+%autosetup -p1
 
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}/%{name}.log {
@@ -111,6 +98,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Thu Jun 29 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-1
+- Update to 1.4.4. Fixes bug #1466318
+- Fix for logger and spaces. Fixes bug #1284403
+
 * Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.2-13
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
 
diff --git a/sources b/sources
index 873ec5b..458900a 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-85ad366b7f3999eb2a9371e39a1a4df7  rkhunter-1.4.2.tar.gz
+SHA512 (rkhunter-1.4.4.tar.gz) = 87e9c617220765678cc4519eee27d1d56185c3a7fb1d6338c8fb984ac4f5176c31bb54b69e1de615d66a0cf1e72b672e66b368e37851a459def69463cbb8661e

From 92139827131e2d87e80903a333a8a98bb80d3936 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
Date: Thu, 13 Jul 2017 10:55:19 +0200
Subject: [PATCH 083/122] perl dependency renamed to perl-interpreter
 <https://fedoraproject.org/wiki/Changes/perl_Package_to_Install_Core_Modules>

---
 rkhunter.spec | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 9b3d533..2f66095 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.4
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -18,7 +18,7 @@ BuildRequires:      perl-generators
 
 Requires:       coreutils, binutils, kmod, findutils, grep
 Requires:       e2fsprogs, procps, lsof, iproute, wget
-Requires:       perl, perl(strict), perl(IO::Socket), mailx, logrotate
+Requires:       perl-interpreter, perl(strict), perl(IO::Socket), mailx, logrotate
 Requires:       crontabs
 
 %description
@@ -98,6 +98,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Thu Jul 13 2017 Petr Pisar <ppisar@redhat.com> - 1.4.4-2
+- perl dependency renamed to perl-interpreter
+  <https://fedoraproject.org/wiki/Changes/perl_Package_to_Install_Core_Modules>
+
 * Thu Jun 29 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-1
 - Update to 1.4.4. Fixes bug #1466318
 - Fix for logger and spaces. Fixes bug #1284403

From 9ce2db8216f8e379c7546fea41bf07b4450130de Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 27 Jul 2017 13:11:28 +0000
Subject: [PATCH 084/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 2f66095..ecc95e6 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.4
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -98,6 +98,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.4-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
 * Thu Jul 13 2017 Petr Pisar <ppisar@redhat.com> - 1.4.4-2
 - perl dependency renamed to perl-interpreter
   <https://fedoraproject.org/wiki/Changes/perl_Package_to_Install_Core_Modules>

From f7a7db4c59930f0b99784054a30ff7e60305ef2e Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 12 Aug 2017 12:21:12 -0700
Subject: [PATCH 085/122] Disable ipc_shared_mem test for now due to false
 positives. Bug #1472299

---
 rkhunter-1.4.4-fedoraconfig.patch | 6 +++---
 rkhunter.spec                     | 5 ++++-
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/rkhunter-1.4.4-fedoraconfig.patch b/rkhunter-1.4.4-fedoraconfig.patch
index ca26113..8f0a83c 100644
--- a/rkhunter-1.4.4-fedoraconfig.patch
+++ b/rkhunter-1.4.4-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.conf
---- rkhunter-1.4.4.orig/files/rkhunter.conf	2017-06-22 18:19:20.000000000 -0600
-+++ rkhunter-1.4.4/files/rkhunter.conf	2017-06-30 14:45:05.104227416 -0600
+--- rkhunter-1.4.4.orig/files/rkhunter.conf	2017-06-22 17:19:20.000000000 -0700
++++ rkhunter-1.4.4/files/rkhunter.conf	2017-08-12 12:17:45.955313658 -0700
 @@ -158,6 +158,7 @@
  # default directory beneath the installation directory.
  #
@@ -64,7 +64,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  ENABLE_TESTS=ALL
 -DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps
 +#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps
-+DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps
++DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps ipc_shared_mem
  
  #
  # The HASH_CMD option can be used to specify the command to use for the file
diff --git a/rkhunter.spec b/rkhunter.spec
index ecc95e6..daa8b26 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.4
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -98,6 +98,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Aug 12 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-4
+- Disable ipc_shared_mem test for now due to false positives. Bug #1472299
+
 * Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.4-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
 

From 287a60a4afc5f8aac82b33ee7203dff9dd6bb225 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Mon, 27 Nov 2017 18:29:27 -0800
Subject: [PATCH 086/122] Add fix for new rpm queryformat and ARCH. Fixes bug
 #1517387

---
 rkhunter-1.4.4-rpmqueryformat.patch | 21 +++++++++++++++++++++
 rkhunter.spec                       |  7 ++++++-
 2 files changed, 27 insertions(+), 1 deletion(-)
 create mode 100644 rkhunter-1.4.4-rpmqueryformat.patch

diff --git a/rkhunter-1.4.4-rpmqueryformat.patch b/rkhunter-1.4.4-rpmqueryformat.patch
new file mode 100644
index 0000000..59b5f8d
--- /dev/null
+++ b/rkhunter-1.4.4-rpmqueryformat.patch
@@ -0,0 +1,21 @@
+diff -Nur rkhunter-1.4.4.orig/files/rkhunter rkhunter-1.4.4/files/rkhunter
+--- rkhunter-1.4.4.orig/files/rkhunter	2017-06-29 00:51:57.000000000 -0700
++++ rkhunter-1.4.4/files/rkhunter	2017-11-27 18:10:04.027860499 -0800
+@@ -6437,7 +6437,7 @@
+ 					FILE_IS_PKGD=1
+ 					PKGNAME=`echo "${RKHTMPVAR}" | tail ${TAIL_OPT}1`
+ 
+-					RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${FNAMEGREP}\$"`
++					RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{=ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${FNAMEGREP}\$"`
+ 					ERRCODE=$?
+ 
+ 					#
+@@ -6453,7 +6453,7 @@
+ 							RKHTMPVAR3="/usr${FNAMEGREP}"
+ 						fi
+ 
+-						RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${RKHTMPVAR3}\$"`
++						RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{=ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${RKHTMPVAR3}\$"`
+ 						ERRCODE=$?
+ 					fi
+ 
diff --git a/rkhunter.spec b/rkhunter.spec
index daa8b26..2fb29e9 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.4
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -13,6 +13,8 @@ Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.ta
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
 Patch0:         rkhunter-1.4.4-fedoraconfig.patch
+# fix queryformat in new rpm. Already upstream, backwards compatible
+Patch1:         rkhunter-1.4.4-rpmqueryformat.patch
 BuildArch:      noarch
 BuildRequires:      perl-generators
 
@@ -98,6 +100,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Mon Nov 27 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-5
+- Add fix for new rpm queryformat and ARCH. Fixes bug #1517387
+
 * Sat Aug 12 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-4
 - Disable ipc_shared_mem test for now due to false positives. Bug #1472299
 

From 72a6e4ea774dbcb54f1b9fd681e5d80c15d1bc16 Mon Sep 17 00:00:00 2001
From: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
Date: Fri, 9 Feb 2018 09:05:57 +0100
Subject: [PATCH 087/122] Escape macros in %changelog

Reference: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/Y2ZUKK2B7T2IKXPMODNF6HB2O5T5TS6H/
Signed-off-by: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
---
 rkhunter.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 2fb29e9..2ace918 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.4
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -100,6 +100,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Feb 09 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 1.4.4-6
+- Escape macros in %%changelog
+
 * Mon Nov 27 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-5
 - Add fix for new rpm queryformat and ARCH. Fixes bug #1517387
 
@@ -207,7 +210,7 @@ EOF
 - Add /usr/share/man/man5/.k5identity.5.gz to whitelisted hidden files. 
 
 * Wed Oct 12 2011 Jim Pirzyk <jim+rpm@pirzyk.org> - 1.3.8-10
-- Update %files section so that some .dat files are marked %ghost
+- Update %%files section so that some .dat files are marked %%ghost
 
 * Fri Aug 05 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-9
 - Add patch to fix ALLOWPROCDELFILE config option. fixes bug #727524

From a811f64f5646560f68b751ba2d607fa30613010b Mon Sep 17 00:00:00 2001
From: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
Date: Wed, 14 Feb 2018 09:17:30 +0100
Subject: [PATCH 088/122] Remove %clean section

None of currently supported distributions need that.
Last one was EL5 which is EOL for a while.

Signed-off-by: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
---
 rkhunter.spec | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 2ace918..7dcd862 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -77,9 +77,6 @@ EOF
 %{__install} -m640 -p files/%{name}.conf        ${RPM_BUILD_ROOT}%{_sysconfdir}/
 %{__install} -m640 -p %{SOURCE3}                ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name}
 
-%clean
-%{__rm} -rf $RPM_BUILD_ROOT
-
 %files
 %defattr(-,root,root,-)
 %doc %{_pkgdocdir}/*

From 545c12f7b7e206473f159b33c171ae3ccb9a5817 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sun, 25 Feb 2018 15:12:57 -0800
Subject: [PATCH 089/122] Update to 1.4.6. Fixes bug #1547315 Allow KRA vault
 log files. Fixes bug #1541472 ipc_shared_mem warning fixed upstream. Fixes
 bug #1524456

---
 rkhunter-1.4.4-rpmqueryformat.patch           | 21 ----------------
 ...patch => rkhunter-1.4.6-fedoraconfig.patch | 25 +++++++++++--------
 rkhunter.spec                                 | 13 ++++++----
 3 files changed, 22 insertions(+), 37 deletions(-)
 delete mode 100644 rkhunter-1.4.4-rpmqueryformat.patch
 rename rkhunter-1.4.4-fedoraconfig.patch => rkhunter-1.4.6-fedoraconfig.patch (91%)

diff --git a/rkhunter-1.4.4-rpmqueryformat.patch b/rkhunter-1.4.4-rpmqueryformat.patch
deleted file mode 100644
index 59b5f8d..0000000
--- a/rkhunter-1.4.4-rpmqueryformat.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff -Nur rkhunter-1.4.4.orig/files/rkhunter rkhunter-1.4.4/files/rkhunter
---- rkhunter-1.4.4.orig/files/rkhunter	2017-06-29 00:51:57.000000000 -0700
-+++ rkhunter-1.4.4/files/rkhunter	2017-11-27 18:10:04.027860499 -0800
-@@ -6437,7 +6437,7 @@
- 					FILE_IS_PKGD=1
- 					PKGNAME=`echo "${RKHTMPVAR}" | tail ${TAIL_OPT}1`
- 
--					RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${FNAMEGREP}\$"`
-+					RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{=ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${FNAMEGREP}\$"`
- 					ERRCODE=$?
- 
- 					#
-@@ -6453,7 +6453,7 @@
- 							RKHTMPVAR3="/usr${FNAMEGREP}"
- 						fi
- 
--						RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${RKHTMPVAR3}\$"`
-+						RPM_QUERY_RESULT_ARCH=`${RPM_CMD} -qf --queryformat '[%{FILEMODES:octal}:%{FILEUSERNAME}:%{FILEGROUPNAME}:%{FILESIZES}:%{FILEMTIMES}:%{FILEMD5S}:%{=ARCH}:%{FILELINKTOS}:%{FILENAMES}\n]' "${FNAME}" 2>/dev/null | grep ":${RKHTMPVAR3}\$"`
- 						ERRCODE=$?
- 					fi
- 
diff --git a/rkhunter-1.4.4-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch
similarity index 91%
rename from rkhunter-1.4.4-fedoraconfig.patch
rename to rkhunter-1.4.6-fedoraconfig.patch
index 8f0a83c..a93cdd9 100644
--- a/rkhunter-1.4.4-fedoraconfig.patch
+++ b/rkhunter-1.4.6-fedoraconfig.patch
@@ -1,6 +1,6 @@
-diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.conf
---- rkhunter-1.4.4.orig/files/rkhunter.conf	2017-06-22 17:19:20.000000000 -0700
-+++ rkhunter-1.4.4/files/rkhunter.conf	2017-08-12 12:17:45.955313658 -0700
+diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf
+--- rkhunter-1.4.6.orig/files/rkhunter.conf	2018-02-19 15:49:06.000000000 -0800
++++ rkhunter-1.4.6/files/rkhunter.conf	2018-02-25 15:07:20.766420580 -0800
 @@ -158,6 +158,7 @@
  # default directory beneath the installation directory.
  #
@@ -68,7 +68,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # The HASH_CMD option can be used to specify the command to use for the file
-@@ -434,6 +441,7 @@
+@@ -435,6 +442,7 @@
  # Also see the PKGMGR_NO_VRFY and USE_SUNSUM options.
  #
  #PKGMGR=NONE
@@ -76,7 +76,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # It is possible that a file, which is part of a package, may have been
-@@ -557,6 +565,14 @@
+@@ -558,6 +566,17 @@
  # The default value is the null string.
  #
  #EXISTWHITELIST=""
@@ -85,13 +85,16 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
 +EXISTWHITELIST=/var/log/pki-ca/system
 +# FreeIPA Certificate Authority
 +EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system
++# FreeIPA with KRA (Password Vault)
++EXISTWHITELIST=/var/log/pki/pki-tomcat/kra/system
++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/kra/system
 +# Some non default installed files we check
 +EXISTWHITELIST=/usr/bin/GET
 +EXISTWHITELIST=/usr/bin/whatis
  
  #
  # Whitelist various attributes of the specified file. The attributes are those
-@@ -587,6 +603,12 @@
+@@ -588,6 +607,12 @@
  # The default value is the null string.
  #
  #SCRIPTWHITELIST=/usr/bin/groups
@@ -104,7 +107,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # Allow the specified file to have the immutable attribute set.
-@@ -617,6 +639,19 @@
+@@ -630,6 +655,19 @@
  #ALLOWHIDDENDIR=/dev/.udev
  #ALLOWHIDDENDIR=/dev/.udevdb
  #ALLOWHIDDENDIR=/dev/.mdadm
@@ -124,7 +127,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -632,6 +667,32 @@
+@@ -645,6 +683,32 @@
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
  #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
@@ -157,7 +160,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -701,6 +762,35 @@
+@@ -714,6 +778,35 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -193,7 +196,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # Allow the specified process pathnames to use shared memory segments.
-@@ -1035,6 +1125,11 @@
+@@ -1090,6 +1183,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -205,7 +208,7 @@ diff -Nur rkhunter-1.4.4.orig/files/rkhunter.conf rkhunter-1.4.4/files/rkhunter.
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1274,3 +1369,5 @@
+@@ -1329,3 +1427,5 @@
  # The default value is '0'.
  #
  #GLOBSTAR=0
diff --git a/rkhunter.spec b/rkhunter.spec
index 7dcd862..5f92a28 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -2,8 +2,8 @@
 %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
 
 Name:           rkhunter
-Version:        1.4.4
-Release:        6%{?dist}
+Version:        1.4.6
+Release:        1%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -12,9 +12,7 @@ URL:            http://rkhunter.sourceforge.net/
 Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
-Patch0:         rkhunter-1.4.4-fedoraconfig.patch
-# fix queryformat in new rpm. Already upstream, backwards compatible
-Patch1:         rkhunter-1.4.4-rpmqueryformat.patch
+Patch0:         rkhunter-1.4.6-fedoraconfig.patch
 BuildArch:      noarch
 BuildRequires:      perl-generators
 
@@ -97,6 +95,11 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Feb 25 2018 Kevin Fenzi <kevin@scrye.com> - 1.4.6-1
+- Update to 1.4.6. Fixes bug #1547315
+- Allow KRA vault log files. Fixes bug #1541472
+- ipc_shared_mem warning fixed upstream. Fixes bug #1524456
+
 * Fri Feb 09 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 1.4.4-6
 - Escape macros in %%changelog
 

From a1f61599370b4d34cbee41bf5a560475c31853d4 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sun, 25 Feb 2018 15:36:23 -0800
Subject: [PATCH 090/122] Also add sources

---
 .gitignore | 1 +
 sources    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 1422757..0486fc1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@ rkhunter-1.3.6.tar.gz
 /rkhunter-1.4.0.tar.gz
 /rkhunter-1.4.2.tar.gz
 /rkhunter-1.4.4.tar.gz
+/rkhunter-1.4.6.tar.gz
diff --git a/sources b/sources
index 458900a..956755f 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (rkhunter-1.4.4.tar.gz) = 87e9c617220765678cc4519eee27d1d56185c3a7fb1d6338c8fb984ac4f5176c31bb54b69e1de615d66a0cf1e72b672e66b368e37851a459def69463cbb8661e
+SHA512 (rkhunter-1.4.6.tar.gz) = c51a21b6b66ed1f73a19d8ce04eaba35999eefcb666acc824989c3bf53ac56d24a33ac4fec290be942e33fe24674406b371eafff73f7e697b9e03ec031b37216

From c36061be216e25baf935bdb7ad5508b43750d9f8 Mon Sep 17 00:00:00 2001
From: Jason Tibbitts <tibbs@math.uh.edu>
Date: Tue, 10 Jul 2018 01:33:55 -0500
Subject: [PATCH 091/122] Remove needless use of %defattr

---
 rkhunter.spec | 1 -
 1 file changed, 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 5f92a28..5d9e472 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -76,7 +76,6 @@ EOF
 %{__install} -m640 -p %{SOURCE3}                ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name}
 
 %files
-%defattr(-,root,root,-)
 %doc %{_pkgdocdir}/*
 %{_bindir}/%{name}
 %dir %{_datadir}/%{name}

From c20f68759374d9a83d85f52ce8b4e6310fd9c519 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 14 Jul 2018 03:38:17 +0000
Subject: [PATCH 092/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 5d9e472..b42ae1f 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -94,6 +94,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
 * Sun Feb 25 2018 Kevin Fenzi <kevin@scrye.com> - 1.4.6-1
 - Update to 1.4.6. Fixes bug #1547315
 - Allow KRA vault log files. Fixes bug #1541472

From 5d155e09e200135758f86a3f5205943ab1b9767e Mon Sep 17 00:00:00 2001
From: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
Date: Mon, 28 Jan 2019 20:18:21 +0100
Subject: [PATCH 093/122] Remove obsolete Group tag

References: https://fedoraproject.org/wiki/Changes/Remove_Group_Tag
---
 rkhunter.spec | 1 -
 1 file changed, 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index b42ae1f..5c96e3a 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -6,7 +6,6 @@ Version:        1.4.6
 Release:        2%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
-Group:          Applications/System
 License:        GPLv2+
 URL:            http://rkhunter.sourceforge.net/
 Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz

From 9114393bb4c14b3a0902b84adf1ebef7c29a6143 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 2 Feb 2019 11:26:58 +0000
Subject: [PATCH 094/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 5c96e3a..8972e2b 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -93,6 +93,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
 * Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
 

From ce2173f1dc39f6976de730638dc09b3005a1ca41 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sun, 14 Apr 2019 16:35:50 -0700
Subject: [PATCH 095/122] Drop ifup/ifdown since network-scripts is now
 deprecated. Fixes bug #1698920

---
 rkhunter-1.4.6-fedoraconfig.patch | 16 +++++++---------
 rkhunter.spec                     |  5 ++++-
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/rkhunter-1.4.6-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch
index a93cdd9..4dbc624 100644
--- a/rkhunter-1.4.6-fedoraconfig.patch
+++ b/rkhunter-1.4.6-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf
 --- rkhunter-1.4.6.orig/files/rkhunter.conf	2018-02-19 15:49:06.000000000 -0800
-+++ rkhunter-1.4.6/files/rkhunter.conf	2018-02-25 15:07:20.766420580 -0800
++++ rkhunter-1.4.6/files/rkhunter.conf	2019-04-14 16:30:22.914740071 -0700
 @@ -158,6 +158,7 @@
  # default directory beneath the installation directory.
  #
@@ -94,7 +94,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  
  #
  # Whitelist various attributes of the specified file. The attributes are those
-@@ -588,6 +607,12 @@
+@@ -588,6 +607,10 @@
  # The default value is the null string.
  #
  #SCRIPTWHITELIST=/usr/bin/groups
@@ -102,12 +102,10 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
 +SCRIPTWHITELIST=/usr/bin/ldd
 +SCRIPTWHITELIST=/usr/bin/groups
 +SCRIPTWHITELIST=/usr/bin/GET
-+SCRIPTWHITELIST=/sbin/ifup
-+SCRIPTWHITELIST=/sbin/ifdown
  
  #
  # Allow the specified file to have the immutable attribute set.
-@@ -630,6 +655,19 @@
+@@ -630,6 +653,19 @@
  #ALLOWHIDDENDIR=/dev/.udev
  #ALLOWHIDDENDIR=/dev/.udevdb
  #ALLOWHIDDENDIR=/dev/.mdadm
@@ -127,7 +125,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -645,6 +683,32 @@
+@@ -645,6 +681,32 @@
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
  #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
@@ -160,7 +158,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -714,6 +778,35 @@
+@@ -714,6 +776,35 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -196,7 +194,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  
  #
  # Allow the specified process pathnames to use shared memory segments.
-@@ -1090,6 +1183,11 @@
+@@ -1090,6 +1181,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -208,7 +206,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1329,3 +1427,5 @@
+@@ -1329,3 +1425,5 @@
  # The default value is '0'.
  #
  #GLOBSTAR=0
diff --git a/rkhunter.spec b/rkhunter.spec
index 8972e2b..93344f3 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -93,6 +93,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Apr 14 2019 Kevin Fenzi <kevin@scrye.com> - 1.4.6-4
+- Drop ifup/ifdown since network-scripts is now deprecated. Fixes bug #1698920
+
 * Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
 

From 36eb0f4abbb063572220bfabf24a2ad4efdb6a15 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 26 Jul 2019 18:37:38 +0000
Subject: [PATCH 096/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 93344f3..e627535 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        4%{?dist}
+Release:        5%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -93,6 +93,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
 * Sun Apr 14 2019 Kevin Fenzi <kevin@scrye.com> - 1.4.6-4
 - Drop ifup/ifdown since network-scripts is now deprecated. Fixes bug #1698920
 

From 5857eb61fa65d8ce2468d6b4c2d3ec474a199082 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sun, 6 Oct 2019 12:39:20 -0700
Subject: [PATCH 097/122] Adjust config for PermitRootLogin change in f31+.
 Fixes bug #1756593

---
 rkhunter-1.4.6-fedoraconfig.patch | 4 ++--
 rkhunter.spec                     | 5 ++++-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/rkhunter-1.4.6-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch
index 4dbc624..a70a6a7 100644
--- a/rkhunter-1.4.6-fedoraconfig.patch
+++ b/rkhunter-1.4.6-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf
 --- rkhunter-1.4.6.orig/files/rkhunter.conf	2018-02-19 15:49:06.000000000 -0800
-+++ rkhunter-1.4.6/files/rkhunter.conf	2019-04-14 16:30:22.914740071 -0700
++++ rkhunter-1.4.6/files/rkhunter.conf	2019-10-06 12:35:15.519680911 -0700
 @@ -158,6 +158,7 @@
  # default directory beneath the installation directory.
  #
@@ -46,7 +46,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  # The default value is 'no'.
  #
  #ALLOW_SSH_ROOT_USER=no
-+ALLOW_SSH_ROOT_USER=yes
++ALLOW_SSH_ROOT_USER=unset
  
  #
  # Set this option to '1' to allow the use of the SSH-1 protocol, but note
diff --git a/rkhunter.spec b/rkhunter.spec
index e627535..7943cb4 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        5%{?dist}
+Release:        6%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -93,6 +93,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Oct 06 2019 Kevin Fenzi <kevin@scrye.com> - 1.4.6-6
+- Adjust config for PermitRootLogin change in f31+. Fixes bug #1756593
+
 * Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-5
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
 

From 5a71981d2ebae6ab9d2f263b1832866b24e9e247 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Thu, 30 Jan 2020 17:43:43 +0000
Subject: [PATCH 098/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 7943cb4..464a784 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        6%{?dist}
+Release:        7%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -93,6 +93,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
 * Sun Oct 06 2019 Kevin Fenzi <kevin@scrye.com> - 1.4.6-6
 - Adjust config for PermitRootLogin change in f31+. Fixes bug #1756593
 

From 4fceddaadaf4a947d51b9107e5a3eddb19a0c00d Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 16 May 2020 14:00:06 -0700
Subject: [PATCH 099/122] Add allow for podman's /dev/shm files (fixes bug
 #1828698 )

---
 rkhunter-1.4.6-fedoraconfig.patch | 10 ++++++----
 rkhunter.spec                     |  5 ++++-
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/rkhunter-1.4.6-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch
index a70a6a7..dcb6b07 100644
--- a/rkhunter-1.4.6-fedoraconfig.patch
+++ b/rkhunter-1.4.6-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf
 --- rkhunter-1.4.6.orig/files/rkhunter.conf	2018-02-19 15:49:06.000000000 -0800
-+++ rkhunter-1.4.6/files/rkhunter.conf	2019-10-06 12:35:15.519680911 -0700
++++ rkhunter-1.4.6/files/rkhunter.conf	2020-05-16 13:51:19.431725722 -0700
 @@ -158,6 +158,7 @@
  # default directory beneath the installation directory.
  #
@@ -158,7 +158,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -714,6 +776,35 @@
+@@ -714,6 +776,37 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -191,10 +191,12 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
 +ALLOWDEVFILE=/dev/shm/qb-pengine-*
 +ALLOWDEVFILE=/dev/shm/qb-quorum-*
 +ALLOWDEVFILE=/dev/shm/qb-stonith-*
++# Allow podman
++ALLOWDEVFILE=/dev/shm/libpod*lock*
  
  #
  # Allow the specified process pathnames to use shared memory segments.
-@@ -1090,6 +1181,11 @@
+@@ -1090,6 +1183,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -206,7 +208,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1329,3 +1425,5 @@
+@@ -1329,3 +1427,5 @@
  # The default value is '0'.
  #
  #GLOBSTAR=0
diff --git a/rkhunter.spec b/rkhunter.spec
index 464a784..4322225 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -93,6 +93,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat May 16 2020 Kevin Fenzi <kevin@scrye.com> - 1.4.6-8
+- Add allow for podman's /dev/shm files (fixes bug #1828698 )
+
 * Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-7
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
 

From 63afb91cf5695010d60b32458ccccf42339ff3df Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 29 Jul 2020 05:48:29 +0000
Subject: [PATCH 100/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 4322225..ded9ff1 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        8%{?dist}
+Release:        9%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -93,6 +93,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
 * Sat May 16 2020 Kevin Fenzi <kevin@scrye.com> - 1.4.6-8
 - Add allow for podman's /dev/shm files (fixes bug #1828698 )
 

From 8e522edf6084c825af79102787520fec039462e5 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 16 Jan 2021 11:08:05 -0800
Subject: [PATCH 101/122] Drop check on libkeyutils, it's a legit library now.
 Fixes rhbz#1914662 Look for and use the ssh.d config snippet direction.
 Thanks John Dodson for patch. Fixes rhbz#1851620

---
 rkhunter-1.4.6-drop-libkeyutils-check.patch | 43 +++++++++++++++++++++
 rkhunter-1.4.6-ssh.d.patch                  | 25 ++++++++++++
 rkhunter.spec                               | 13 ++++++-
 3 files changed, 79 insertions(+), 2 deletions(-)
 create mode 100644 rkhunter-1.4.6-drop-libkeyutils-check.patch
 create mode 100644 rkhunter-1.4.6-ssh.d.patch

diff --git a/rkhunter-1.4.6-drop-libkeyutils-check.patch b/rkhunter-1.4.6-drop-libkeyutils-check.patch
new file mode 100644
index 0000000..b35ceaa
--- /dev/null
+++ b/rkhunter-1.4.6-drop-libkeyutils-check.patch
@@ -0,0 +1,43 @@
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6.orig/files/rkhunter	2018-02-24 15:08:27.000000000 -0800
++++ rkhunter-1.4.6/files/rkhunter	2021-01-15 12:47:54.399665856 -0800
+@@ -8370,9 +8370,7 @@
+ 		     /lib/libsbr.so
+ 		     /lib64/libsbr.so
+ 		     /lib/libslr.so
+-		     /lib64/libslr.so
+-		     /lib/tls/libkeyutils.so.1
+-		     /lib64/tls/libkeyutils.so.1"
++		     /lib64/libslr.so"
+ 	EBURY_DIRS=
+ 	EBURY_KSYMS=
+ 
+@@ -9762,10 +9760,6 @@
+ 		  file:/usr/share/sshd.sync:Trojaned SSH daemon
+ 		  file:/bin/zcut:Trojaned SSH daemon
+ 		  file:/usr/bin/zmuie:Trojaned SSH daemon
+-		  file:/lib/libkeyutils.so.1.9:Sniffer component
+-		  file:/lib64/libkeyutils.so.1.9:Sniffer component
+-		  file:/usr/lib/libkeyutils.so.1.9:Sniffer component
+-		  file:/usr/lib64/libkeyutils.so.1.9:Sniffer component
+ 		  file:/IptabLes:malware component
+ 		  file:/.IptabLex:malware component
+ 		  file:/boot/.IptabLex:malware component
+@@ -9956,7 +9950,6 @@
+ 			 ssh-scan:Port scanner
+ 			 atac:Port scanner component
+ 			 \[pdflush\]:IRC bot
+-			 libkeyutils.so.1.9:Spam tool component
+ 			 .IptabLex:malware component
+ 			 .IptabLes:malware component
+ 			 .flush:malware component
+diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb
+--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb	2017-11-29 08:14:02.000000000 -0800
++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb	1969-12-31 16:00:00.000000000 -0800
+@@ -1 +0,0 @@
+-RKH_libkeyutils.so.1.9-v1;Target:0;(((0&1&2)|(3&4&5))&((6&7&8)|(9&10)));58636174;58766572;58626e64;73686d6174;73686d6474;73686d676574;62696e64;636f6e6e656374;736f636b6574;737973636f6e66;746d7066696c65
+diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb
+--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb	2017-11-29 08:14:02.000000000 -0800
++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb	1969-12-31 16:00:00.000000000 -0800
+@@ -1 +0,0 @@
+-RKH_libkeyutils.1.9.so;Target:0;(0&1&2&3&4&5&6&7&8&9&10&11&12&13&14&15&16);737973636f6e66;746d7066696c65;77616974706964;736f636b6574;636f6e6e656374;73686d6174;73686d6474;73686d676574;73656d676574;73656d74696d65646f70;736c656570;737072696e7466;7372616e64;7374646f7574;737472636174;737472637079;5f5f737472647570
diff --git a/rkhunter-1.4.6-ssh.d.patch b/rkhunter-1.4.6-ssh.d.patch
new file mode 100644
index 0000000..5c8997f
--- /dev/null
+++ b/rkhunter-1.4.6-ssh.d.patch
@@ -0,0 +1,25 @@
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6.orig/files/rkhunter	2021-01-16 10:32:13.969438340 -0800
++++ rkhunter-1.4.6/files/rkhunter	2021-01-16 10:35:59.737149750 -0800
+@@ -17379,6 +17379,12 @@
+ 			fi
+ 		done
+ 
++			if [ -d "${SSH_CONFIG_FILE}.d" ];then
++				SSH_CONFIG_FILE="${SSH_CONFIG_FILE} ${SSH_CONFIG_FILE}.d/*"
++			else
++				:
++			fi
++
+ 		if [ -n "${SSH_CONFIG_FILE}" ]; then
+ 			display --to SCREEN+LOG --type PLAIN --result FOUND --color GREEN --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_FILE_SSH
+ 
+@@ -17396,7 +17402,7 @@
+ 			# First we check for allowed root access.
+ 			#
+ 
+-			RKHTMPVAR=`grep -i '^[ 	]*PermitRootLogin[ 	=]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1`
++			RKHTMPVAR=`grep -ih '^[         ]*PermitRootLogin[      =]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+ 				#
diff --git a/rkhunter.spec b/rkhunter.spec
index ded9ff1..f97897c 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        9%{?dist}
+Release:        10%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -12,6 +12,10 @@ Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.ta
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
 Patch0:         rkhunter-1.4.6-fedoraconfig.patch
+# libkeyutils is an actual legit library now, so this old check is a false positive.
+Patch1:         rkhunter-1.4.6-drop-libkeyutils-check.patch
+# have ssh checks use the sshd.d directoy config files too.
+Patch2:         rkhunter-1.4.6-ssh.d.patch
 BuildArch:      noarch
 BuildRequires:      perl-generators
 
@@ -82,9 +86,10 @@ EOF
 %{_sysconfdir}/cron.daily/%{name}
 %config(noreplace) %{_sysconfdir}/logrotate.d/%{name}
 %dir %{_var}/lib/%{name}
-%{_var}/lib/%{name}/db
+%dir %{_var}/lib/%{name}/db
 %ghost %{_var}/lib/%{name}/db/mirrors.dat
 %ghost %{_var}/lib/%{name}/db/programs_bad.dat
+%ghost %{_var}/lib/%{name}/db/backdoorports.dat
 %{_var}/lib/%{name}/db/i18n
 %dir %{_var}/log/%{name}
 %config(noreplace) %{_sysconfdir}/%{name}.conf
@@ -93,6 +98,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Jan 16 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-10
+- Drop check on libkeyutils, it's a legit library now. Fixes rhbz#1914662
+- Look for and use the ssh.d config snippet direction. Thanks John Dodson for patch. Fixes rhbz#1851620
+
 * Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-9
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
 

From a8f5de252c42bbca1eaa69042e435e37e56fa2bc Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Wed, 27 Jan 2021 15:20:53 +0000
Subject: [PATCH 102/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index f97897c..7154c04 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        10%{?dist}
+Release:        11%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -98,6 +98,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
 * Sat Jan 16 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-10
 - Drop check on libkeyutils, it's a legit library now. Fixes rhbz#1914662
 - Look for and use the ssh.d config snippet direction. Thanks John Dodson for patch. Fixes rhbz#1851620

From dde37ecefa85de9f1331d87aee25e4596a822b6c Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sun, 7 Feb 2021 14:12:26 -0800
Subject: [PATCH 103/122] Fix bug around ssh protocol detection ( rhbz#1597635
 )

---
 rkhunter-1.4.6-ssh.d.patch | 22 ++++++++++++++++++++--
 rkhunter.spec              |  5 ++++-
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/rkhunter-1.4.6-ssh.d.patch b/rkhunter-1.4.6-ssh.d.patch
index 5c8997f..244279c 100644
--- a/rkhunter-1.4.6-ssh.d.patch
+++ b/rkhunter-1.4.6-ssh.d.patch
@@ -1,6 +1,6 @@
 diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
---- rkhunter-1.4.6.orig/files/rkhunter	2021-01-16 10:32:13.969438340 -0800
-+++ rkhunter-1.4.6/files/rkhunter	2021-01-16 10:35:59.737149750 -0800
+--- rkhunter-1.4.6.orig/files/rkhunter	2021-02-07 13:58:43.355270731 -0800
++++ rkhunter-1.4.6/files/rkhunter	2021-02-07 14:02:41.551554134 -0800
 @@ -17379,6 +17379,12 @@
  			fi
  		done
@@ -23,3 +23,21 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunt
  
  			if [ -n "${RKHTMPVAR}" ]; then
  				#
+@@ -17427,7 +17433,7 @@
+ 			# Next we check to see if protocol version 1 is allowed.
+ 			#
+ 
+-			RKHTMPVAR=`grep -i '^[ 	]*Protocol[ 	=]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1`
++			RKHTMPVAR=`grep -i '^[ 	]*Protocol[ 	=]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+ 				#
+@@ -17467,7 +17473,7 @@
+ 			# First check for the Ebury backdoor.
+ 			#
+ 
+-			RKHTMPVAR=`grep -i '^[ 	]*AuthorizedKeysFile[ 	=]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1`
++			RKHTMPVAR=`grep -i '^[ 	]*AuthorizedKeysFile[ 	=]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+ 				RKHTMPVAR2=`echo ${RKHTMPVAR} | sed -e 's/^[^ 	=]*[ 	]*=*[ 	]*\([^ 	#]*\).*$/\1/'`
diff --git a/rkhunter.spec b/rkhunter.spec
index 7154c04..ecdb283 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        11%{?dist}
+Release:        12%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -98,6 +98,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Feb 07 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-12
+- Fix bug around ssh protocol detection ( rhbz#1597635 )
+
 * Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-11
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
 

From 4845f0667d2ae546774584b47104bafb55c23838 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 23 Jul 2021 11:28:44 +0000
Subject: [PATCH 104/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index ecdb283..838884a 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        12%{?dist}
+Release:        13%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -98,6 +98,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
 * Sun Feb 07 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-12
 - Fix bug around ssh protocol detection ( rhbz#1597635 )
 

From 8723338aceba9f85c33af8c0434073f99edb1f35 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 6 Nov 2021 10:41:20 -0700
Subject: [PATCH 105/122] Add exclude for containers-common man page (
 rhbz#2020015 )

---
 rkhunter-1.4.6-fedoraconfig.patch | 14 ++++++++------
 rkhunter.spec                     |  5 ++++-
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/rkhunter-1.4.6-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch
index dcb6b07..66a6c40 100644
--- a/rkhunter-1.4.6-fedoraconfig.patch
+++ b/rkhunter-1.4.6-fedoraconfig.patch
@@ -1,6 +1,6 @@
-diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf
 --- rkhunter-1.4.6.orig/files/rkhunter.conf	2018-02-19 15:49:06.000000000 -0800
-+++ rkhunter-1.4.6/files/rkhunter.conf	2020-05-16 13:51:19.431725722 -0700
++++ rkhunter-1.4.6/files/rkhunter.conf	2021-11-06 10:35:34.691842873 -0700
 @@ -158,6 +158,7 @@
  # default directory beneath the installation directory.
  #
@@ -125,7 +125,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -645,6 +681,32 @@
+@@ -645,6 +681,34 @@
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
  #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
@@ -155,10 +155,12 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
 +ALLOWHIDDENFILE=/etc/.bzrignore
 +# systemd
 +ALLOWHIDDENFILE=/etc/.updated
++# containers-common
++ALLOWHIDDENFILE=/usr/share/man/man5/.containerignore.5.gz
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -714,6 +776,37 @@
+@@ -714,6 +778,37 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -196,7 +198,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  
  #
  # Allow the specified process pathnames to use shared memory segments.
-@@ -1090,6 +1183,11 @@
+@@ -1090,6 +1185,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -208,7 +210,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1329,3 +1427,5 @@
+@@ -1329,3 +1429,5 @@
  # The default value is '0'.
  #
  #GLOBSTAR=0
diff --git a/rkhunter.spec b/rkhunter.spec
index 838884a..312efdc 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        13%{?dist}
+Release:        14%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -98,6 +98,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Nov 06 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-14
+- Add exclude for containers-common man page ( rhbz#2020015 )
+
 * Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-13
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
 

From 56adbc656a5f3dbd4b00b4f5e4d36ca6c837efc5 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 21 Jan 2022 17:53:33 +0000
Subject: [PATCH 106/122] - Rebuilt for
 https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 312efdc..8c375e3 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        14%{?dist}
+Release:        15%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -98,6 +98,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
 * Sat Nov 06 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-14
 - Add exclude for containers-common man page ( rhbz#2020015 )
 

From dacfb9e4cfe20d9d9b803b525cb81d1d0f7d34ac Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 11 Jun 2022 10:06:14 -0700
Subject: [PATCH 107/122] Whitelist .dockerignore man page ( rhbz#2050551 )

---
 rkhunter-1.4.6-fedoraconfig.patch | 12 +++++++-----
 rkhunter.spec                     |  5 ++++-
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/rkhunter-1.4.6-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch
index 66a6c40..143564d 100644
--- a/rkhunter-1.4.6-fedoraconfig.patch
+++ b/rkhunter-1.4.6-fedoraconfig.patch
@@ -1,6 +1,6 @@
 diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf
 --- rkhunter-1.4.6.orig/files/rkhunter.conf	2018-02-19 15:49:06.000000000 -0800
-+++ rkhunter-1.4.6/files/rkhunter.conf	2021-11-06 10:35:34.691842873 -0700
++++ rkhunter-1.4.6/files/rkhunter.conf	2022-06-11 09:58:09.740944517 -0700
 @@ -158,6 +158,7 @@
  # default directory beneath the installation directory.
  #
@@ -125,7 +125,7 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/r
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -645,6 +681,34 @@
+@@ -645,6 +681,36 @@
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
  #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
@@ -157,10 +157,12 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/r
 +ALLOWHIDDENFILE=/etc/.updated
 +# containers-common
 +ALLOWHIDDENFILE=/usr/share/man/man5/.containerignore.5.gz
++# containers-common (older versions)
++ALLOWHIDDENFILE=/usr/share/man/man5/.dockerignore.5.gz
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -714,6 +778,37 @@
+@@ -714,6 +780,37 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
@@ -198,7 +200,7 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/r
  
  #
  # Allow the specified process pathnames to use shared memory segments.
-@@ -1090,6 +1185,11 @@
+@@ -1090,6 +1187,11 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
@@ -210,7 +212,7 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/r
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1329,3 +1429,5 @@
+@@ -1329,3 +1431,5 @@
  # The default value is '0'.
  #
  #GLOBSTAR=0
diff --git a/rkhunter.spec b/rkhunter.spec
index 8c375e3..b13fd39 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        15%{?dist}
+Release:        16%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -98,6 +98,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Jun 11 2022 Kevin Fenzi <kevin@scrye.com> - 1.4.6-16
+- Whitelist .dockerignore man page ( rhbz#2050551 )
+
 * Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-15
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
 

From 44210e0646c105a0f268dc3aa2edd595ddd75ecd Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sun, 19 Jun 2022 15:06:25 -0700
Subject: [PATCH 108/122] Switch to using s-nail instead of mailx.

---
 rkhunter.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index b13fd39..659e13d 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        16%{?dist}
+Release:        17%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -21,7 +21,7 @@ BuildRequires:      perl-generators
 
 Requires:       coreutils, binutils, kmod, findutils, grep
 Requires:       e2fsprogs, procps, lsof, iproute, wget
-Requires:       perl-interpreter, perl(strict), perl(IO::Socket), mailx, logrotate
+Requires:       perl-interpreter, perl(strict), perl(IO::Socket), s-nail, logrotate
 Requires:       crontabs
 
 %description
@@ -98,6 +98,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun Jun 19 2022 Kevin Fenzi <kevin@scrye.com> - 1.4.6-17
+- Switch to using s-nail instead of mailx.
+
 * Sat Jun 11 2022 Kevin Fenzi <kevin@scrye.com> - 1.4.6-16
 - Whitelist .dockerignore man page ( rhbz#2050551 )
 

From 7793e743e6ff55c00592b51fbf62e4f2362a91c8 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 23 Jul 2022 00:52:33 +0000
Subject: [PATCH 109/122] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 659e13d..c704bda 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        17%{?dist}
+Release:        18%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -98,6 +98,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-18
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
 * Sun Jun 19 2022 Kevin Fenzi <kevin@scrye.com> - 1.4.6-17
 - Switch to using s-nail instead of mailx.
 

From 7982b85a2a4af19c6d3f36bc9ae394ee4d13fe69 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 20 Jan 2023 19:48:37 +0000
Subject: [PATCH 110/122] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index c704bda..993a921 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        18%{?dist}
+Release:        19%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -98,6 +98,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-19
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
 * Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-18
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
 

From 48e94c27b207df7e3115f1868f1c1018f788c82c Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Thu, 20 Apr 2023 18:02:26 -0700
Subject: [PATCH 111/122] Patch grep/egrep changes to avoid warnings in F38+

---
 rkhunter-1.4.6-grep.patch | 712 ++++++++++++++++++++++++++++++++++++++
 rkhunter.spec             |   7 +-
 2 files changed, 718 insertions(+), 1 deletion(-)
 create mode 100644 rkhunter-1.4.6-grep.patch

diff --git a/rkhunter-1.4.6-grep.patch b/rkhunter-1.4.6-grep.patch
new file mode 100644
index 0000000..8331ccf
--- /dev/null
+++ b/rkhunter-1.4.6-grep.patch
@@ -0,0 +1,712 @@
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6.orig/files/rkhunter	2023-04-10 10:44:16.226859554 -0700
++++ rkhunter-1.4.6/files/rkhunter	2023-04-20 17:57:11.365373544 -0700
+@@ -70,7 +70,7 @@
+ # we exec to log everything to the debug file.
+ #
+ 
+-if [ -n "`echo \"$*\" | grep '\-\-debug'`" ]; then
++if [ -n "`echo \"$*\" | grep '\--debug'`" ]; then
+ 	RKHDEBUGFILE=""
+ 	RKHDEBUGBASE="/tmp/rkhunter-debug"
+ 
+@@ -181,9 +181,9 @@
+ # used. If it is, then some typical grep tests will fail.
+ #
+ 
+-if [ "`echo \"rkh-grep-test\" | grep '^\+'`" = "rkh-grep-test" ]; then
++#if [ "`echo \"rkh-grep-test\" | grep '^\+'`" = "rkh-grep-test" ]; then
+ 	alias grep='grep -E'
+-fi
++#fi
+ 
+ 
+ #
+@@ -948,9 +948,9 @@
+ 		#
+ 
+ 		if [ "${OPT_NAME}" = "SHARED_LIB_WHITELIST" ]; then
+-			RKHTMPVAR=`echo "${OPT_VALUE}" | egrep '(^|[^\\])[][?*]'`
++			RKHTMPVAR=`echo "${OPT_VALUE}" | grep '(^|[^\\])[][?*]'`
+ 		else
+-			RKHTMPVAR=`echo "${OPT_VALUE}" | egrep '(^|[^\\])[][?*{}]'`
++			RKHTMPVAR=`echo "${OPT_VALUE}" | grep '(^|[^\\])[][?*{}]'`
+ 		fi
+ 
+ 		if [ -n "${RKHTMPVAR}" ]; then
+@@ -1000,7 +1000,7 @@
+ 		# Also check that '/' has not been set.
+ 		#
+ 
+-		if [ -n "`echo \"${FNAME}\" | egrep '(^[./]*$)|[;&]|/\.\./'`" ]; then
++		if [ -n "`echo \"${FNAME}\" | grep '(^[./]*$)|[;&]|/\.\./'`" ]; then
+ 			ERRCODE=1
+ 
+ 			echo "Invalid ${OPT_NAME} configuration option: Invalid pathname: ${FNAME}"
+@@ -1134,7 +1134,7 @@
+ 				#
+ 
+ 				if [ "${OPT_NAME}" = "SHARED_LIB_WHITELIST" ]; then
+-					if [ -n "`echo \"${FNAME}\" | egrep '\\$\\{?(ORIGIN|LIB|PLATFORM)\\}?'`" ]; then
++					if [ -n "`echo \"${FNAME}\" | grep '\\$\\{?(ORIGIN|LIB|PLATFORM)\\}?'`" ]; then
+ 						continue
+ 					fi
+ 				fi
+@@ -3848,7 +3848,7 @@
+ 		#
+ 
+ 		for RKHTMPVAR2 in ${RKHTMPVAR}; do
+-			if [ -n "`echo \"${RKHTMPVAR2}\" | egrep -i '^(TCP|UDP):[1-9][0-9]*$'`" ]; then
++			if [ -n "`echo \"${RKHTMPVAR2}\" | grep -i '^(TCP|UDP):[1-9][0-9]*$'`" ]; then
+ 				PROTO=`echo ${RKHTMPVAR2} | cut -d: -f1 | tr '[:lower:]' '[:upper:]'`
+ 				PORT=`echo ${RKHTMPVAR2} | cut -d: -f2`
+ 
+@@ -3899,7 +3899,7 @@
+ 				PROTO=""
+ 
+ 				# Dig out the protocol and port number, if present.
+-				if [ -n "`echo \"${RKHTMPVAR2}\" | egrep -i '.:(TCP|UDP):[1-9][0-9]*$'`" ]; then
++				if [ -n "`echo \"${RKHTMPVAR2}\" | grep -i '.:(TCP|UDP):[1-9][0-9]*$'`" ]; then
+ 					PROTO=`echo "${RKHTMPVAR2}" | sed -e 's/^.*:\([a-zA-Z]*\):[1-9][0-9]*$/\1/'`
+ 					PORT=`echo "${RKHTMPVAR2}" | sed -e 's/^.*:\([1-9][0-9]*\)$/\1/'`
+ 
+@@ -4839,7 +4839,7 @@
+ 		fi
+ 	fi
+ 
+-	if [ -n "`echo \"${HASH_FUNC}\" | egrep -i '^(MD5|SHA1|SHA224|SHA256|SHA384|SHA512|RIPEMD160|WHIRLPOOL|NONE)$'`" ]; then
++	if [ -n "`echo \"${HASH_FUNC}\" | grep -i '^(MD5|SHA1|SHA224|SHA256|SHA384|SHA512|RIPEMD160|WHIRLPOOL|NONE)$'`" ]; then
+ 		HASH_FUNC=`echo "${HASH_FUNC}" | tr '[:lower:]' '[:upper:]'`
+ 	fi
+ 
+@@ -6412,7 +6412,7 @@
+ 		OSNAME="${OSNAME} `sw_vers 2>/dev/null | grep '^ProductVersion:' | sed -e 's/ProductVersion:[ 	]*//'`"
+ #		OSNAME="${OSNAME} `sysctl kern.version 2>/dev/null | sed -e 's/^kern.version = //' | cut -d: -f1`"
+ 
+-		if [ -n "`sysctl -a 2>/dev/null | egrep '^(hw\.optional\.x86_64|hw\.optional\.64bitops|hw\.cpu64bit_capable).*1$'`" ]; then
++		if [ -n "`sysctl -a 2>/dev/null | grep '^(hw\.optional\.x86_64|hw\.optional\.64bitops|hw\.cpu64bit_capable).*1$'`" ]; then
+ 			OSNAME="${OSNAME} (64-bit capable)"
+ 		fi
+ 		;;
+@@ -6708,7 +6708,7 @@
+ 						# this is what RPM does).
+ 						#
+ 
+-						RPM_QUERY_RESULT=`echo "${RPM_QUERY_RESULT_ARCH}" | egrep ':(x86_64|ia64):' 2>/dev/null | tail ${TAIL_OPT}1`
++						RPM_QUERY_RESULT=`echo "${RPM_QUERY_RESULT_ARCH}" | grep ':(x86_64|ia64):' 2>/dev/null | tail ${TAIL_OPT}1`
+ 
+ 						test -z "${RPM_QUERY_RESULT}" && RPM_QUERY_RESULT=`echo "${RPM_QUERY_RESULT_ARCH}" | tail ${TAIL_OPT}1`
+ 
+@@ -6883,7 +6883,7 @@
+ 					if [ -n "${PKGNAME}" ]; then
+ 						if [ -f "/var/lib/dpkg/info/${PKGNAME}.md5sums" ]; then
+ 							FILNAM=`echo "${FNAME}" | sed -e 's:^/::; s:\.:\\\.:g'`
+-							SYSHASH=`egrep "( |\./)${FILNAM}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" 2>/dev/null | cut -d' ' -f1`
++							SYSHASH=`grep "( |\./)${FILNAM}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" 2>/dev/null | cut -d' ' -f1`
+ 							test -n "${SYSHASH}" && FILE_IS_PKGD=1
+ 						fi
+ 					fi
+@@ -6925,7 +6925,7 @@
+ 					SYSHASH=""
+ 					RKHTMPVAR=`${HASH_CMD} "${FNAME}" 2>&1`
+ 
+-					if [ -n "`echo \"${RKHTMPVAR}\" | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
++					if [ -n "`echo \"${RKHTMPVAR}\" | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
+ 						DEPENDENCY_ERR=1
+ 						RKHTMPVAR=`echo "${RKHTMPVAR}" | tr '\n' ':' | sed -e 's/:$//'`
+ 					else
+@@ -7311,13 +7311,13 @@
+ 
+ 	case $MIRRORS_MODE in
+ 	0)
+-		MIRROR=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
++		MIRROR=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
+ 		;;
+ 	1)
+-		MIRROR=`egrep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
++		MIRROR=`grep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
+ 		;;
+ 	2)
+-		MIRROR=`egrep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
++		MIRROR=`grep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
+ 		;;
+ 	esac
+ 
+@@ -7337,13 +7337,13 @@
+ 
+ 		case $MIRRORS_MODE in
+ 		0)
+-			MIRROR=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
++			MIRROR=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
+ 			;;
+ 		1)
+-			MIRROR=`egrep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
++			MIRROR=`grep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
+ 			;;
+ 		2)
+-			MIRROR=`egrep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
++			MIRROR=`grep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
+ 			;;
+ 		esac
+ 
+@@ -7370,7 +7370,7 @@
+ 	# Next get the remaining mirrors.
+ 	#
+ 
+-	OTHERMIRRORS=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | grep -v "^${MIRROR}\$"`
++	OTHERMIRRORS=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | grep -v "^${MIRROR}\$"`
+ 
+ 
+ 	#
+@@ -7459,13 +7459,13 @@
+ 
+ 		case $MIRRORS_MODE in
+ 		0)
+-			MIRROR_COUNT=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
++			MIRROR_COUNT=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
+ 			;;
+ 		1)
+-			MIRROR_COUNT=`egrep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
++			MIRROR_COUNT=`grep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
+ 			;;
+ 		2)
+-			MIRROR_COUNT=`egrep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
++			MIRROR_COUNT=`grep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
+ 			;;
+ 		esac
+ 
+@@ -7991,7 +7991,7 @@
+ 	# Now check to see if any unknown options have been configured.
+ 	#
+ 
+-	RKHTMPVAR=`egrep -h -v '^[ 	]*(#|$)' ${CONFIGFILE} ${LOCALCONFIGFILE} ${LOCALCONFDIRFILES}`
++	RKHTMPVAR=`grep -h -v '^[ 	]*(#|$)' ${CONFIGFILE} ${LOCALCONFIGFILE} ${LOCALCONFDIRFILES}`
+ 
+ 	IFS=$IFSNL
+ 
+@@ -10705,7 +10705,7 @@
+ 		done
+ 
+ 
+-		if [ -n "`echo \"${RKHTMPVAR}\" | egrep 'libsafe|missing|empty'`" ]; then
++		if [ -n "`echo \"${RKHTMPVAR}\" | grep 'libsafe|missing|empty'`" ]; then
+ 			display --to LOG --type WARNING --nl PROPUPD_WARN
+ 		fi
+ 
+@@ -10957,7 +10957,7 @@
+ 
+ 						FILE_IS_PKGD=1
+ 
+-						PKGNAME=`echo "${PKGNAME_ARCH}" | egrep '\.(x86_64|ia64)$' 2>/dev/null | tail ${TAIL_OPT}1`
++						PKGNAME=`echo "${PKGNAME_ARCH}" | grep '\.(x86_64|ia64)$' 2>/dev/null | tail ${TAIL_OPT}1`
+ 
+ 						test -z "${PKGNAME}" && PKGNAME=`echo "${PKGNAME_ARCH}" | tail ${TAIL_OPT}1`
+ 
+@@ -11156,7 +11156,7 @@
+ 					if [ -n "${PKGNAME}" -a -f "/var/lib/dpkg/info/${PKGNAME}.md5sums" ]; then
+ 						FNGREP=`echo "${FNAMEGREP}" | sed -e 's:^/::'`
+ 
+-						SYSHASH=`egrep "( |\./)${FNGREP}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" | cut -d' ' -f1`
++						SYSHASH=`grep "( |\./)${FNGREP}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" | cut -d' ' -f1`
+ 
+ 						if [ -n "${SYSHASH}" ]; then
+ 							FILE_IS_PKGD=1
+@@ -11165,7 +11165,7 @@
+ 							if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then
+ 								PKGMGR_VERIFY_RESULT="5"
+ 
+-								if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
++								if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
+ 									DEPENDENCY_ERR=1
+ 								fi
+ 							fi
+@@ -11214,7 +11214,7 @@
+ 							if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then
+ 								PKGMGR_VERIFY_RESULT="5"
+ 
+-								if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
++								if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
+ 									DEPENDENCY_ERR=1
+ 								fi
+ 							fi
+@@ -11245,7 +11245,7 @@
+ 							if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then
+ 								PKGMGR_VERIFY_RESULT="5"
+ 
+-								if [ -n "`${PKGMGR_SHA_HASH} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
++								if [ -n "`${PKGMGR_SHA_HASH} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
+ 									DEPENDENCY_ERR=1
+ 								fi
+ 							fi
+@@ -11288,7 +11288,7 @@
+ 						fi
+ 					fi
+ 
+-					if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | egrep '5|(^..\?)'`" ]; then
++					if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep '5|(^..\?)'`" ]; then
+ 						HASH_TEST_PASSED=1
+ 					else
+ 						TEST_RESULT="${TEST_RESULT} verify:hashchanged"
+@@ -11342,7 +11342,7 @@
+ 							SYSHASH=`${HASH_CMD} "${FNAME}" 2>/dev/null | cut -d' ' -f $HASH_FLD_IDX`
+ 
+ 							if [ -z "${SYSHASH}" ]; then
+-								if [ -n "`${HASH_CMD} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
++								if [ -n "`${HASH_CMD} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
+ 									if [ "${RKHHASH}" = "ignore-prelink-dep-err" ]; then
+ 										SYSHASH="${RKHHASH}"
+ 										display --to LOG --type INFO FILE_PROP_IGNORE_PRELINK_DEP_ERR "`name2text \"${FNAME}\"`"
+@@ -11438,7 +11438,7 @@
+ 					#
+ 
+ 					if [ $FILE_IS_PKGD -eq 1 ]; then
+-						echo "${PKGMGR_VERIFY_RESULT}" | egrep 'M|(^.\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:permchanged"
++						echo "${PKGMGR_VERIFY_RESULT}" | grep 'M|(^.\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:permchanged"
+ 					else
+ 						RKH_CC2=`expr $RKH_CC + 2`
+ 
+@@ -11458,7 +11458,7 @@
+ 					#
+ 
+ 					if [ $FILE_IS_PKGD -eq 1 ]; then
+-						echo "${PKGMGR_VERIFY_RESULT}" | egrep 'U|(^.....\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:uidchanged"
++						echo "${PKGMGR_VERIFY_RESULT}" | grep 'U|(^.....\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:uidchanged"
+ 					else
+ 						RKH_CC2=`expr $RKH_CC + 3`
+ 
+@@ -11478,7 +11478,7 @@
+ 					#
+ 
+ 					if [ $FILE_IS_PKGD -eq 1 ]; then
+-						echo "${PKGMGR_VERIFY_RESULT}" | egrep 'G|(^......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:gidchanged"
++						echo "${PKGMGR_VERIFY_RESULT}" | grep 'G|(^......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:gidchanged"
+ 					else
+ 						RKH_CC2=`expr $RKH_CC + 4`
+ 
+@@ -11518,7 +11518,7 @@
+ 					#
+ 
+ 					if [ $FILE_IS_PKGD -eq 1 ]; then
+-						if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | egrep 'S|(^\?)'`" ]; then
++						if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep 'S|(^\?)'`" ]; then
+ 							SIZE_TEST_PASSED=1
+ 						else
+ 							TEST_RESULT="${TEST_RESULT} verify:sizechanged"
+@@ -11546,7 +11546,7 @@
+ 					#
+ 
+ 					if [ $FILE_IS_PKGD -eq 1 ]; then
+-						echo "${PKGMGR_VERIFY_RESULT}" | egrep 'T|(^.......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:dtmchanged"
++						echo "${PKGMGR_VERIFY_RESULT}" | grep 'T|(^.......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:dtmchanged"
+ 					elif [ $PRELINKED -eq 0 -o $FILE_IS_PKGD -eq 0 ]; then
+ 						RKH_CC2=`expr $RKH_CC + 6`
+ 
+@@ -11567,7 +11567,7 @@
+ 
+ 					if [ -h "${FNAME}" ]; then
+ 						if [ $FILE_IS_PKGD -eq 1 ]; then
+-							if [ -n "`echo \"${PKGMGR_VERIFY_RESULT}\" | egrep 'L|(^....\?)'`" ]; then
++							if [ -n "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep 'L|(^....\?)'`" ]; then
+ 								if [ $HAVE_READLINK -eq 1 ]; then
+ 									# Check the link target to see if it is whitelisted.
+ 
+@@ -11713,7 +11713,7 @@
+ 						RKHTMPVAR=`${LSATTR_CMD} "${FNAME}" 2>&1 | cut -d' ' -f1 | grep 'i'`
+ 					fi
+ 				else
+-					RKHTMPVAR=`ls -lno "${FNAME}" 2>&1 | ${AWK_CMD} '{ print $5 }' | egrep 'uchg|schg|sappnd|uappnd|sunlnk|sunlink|schange|simmutable|sappend|uappend|uchange|uimmutable'`
++					RKHTMPVAR=`ls -lno "${FNAME}" 2>&1 | ${AWK_CMD} '{ print $5 }' | grep 'uchg|schg|sappnd|uappnd|sunlnk|sunlink|schange|simmutable|sappend|uappend|uchange|uimmutable'`
+ 				fi
+ 
+ 				#
+@@ -11761,9 +11761,9 @@
+ 					test -n "${BASENAME_CMD}" && RKHTMPVAR=`${BASENAME_CMD} "${FNAME}"` || RKHTMPVAR=`echo "${FNAME}" | sed -e 's:^.*/::'`
+ 
+ 					if [ "${RKHTMPVAR}" = "rkhunter" ]; then
+-						SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | egrep -i -v '(shell|/bin/sh) script( |,|$)'`
++						SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | grep -i -v '(shell|/bin/sh) script( |,|$)'`
+ 					else
+-						SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | egrep -i ' script( |,|$)'`
++						SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | grep -i ' script( |,|$)'`
+ 					fi
+ 
+ 					test -n "${SYSSCRIPT}" && TEST_RESULT="${TEST_RESULT} script"
+@@ -12246,10 +12246,10 @@
+ 				test ! -e "${SUSPSCAN_ITEM}" && continue
+ 
+ 				#
+-				# Adding "text" to the egrep below widens scope at the expense of more false-positives and extending running time.
++				# Adding "text" to the grep below widens scope at the expense of more false-positives and extending running time.
+ 				#
+ 
+-				if [ -n "`echo \"${FTYPE}\" | grep -v -i 'compres' | egrep -i 'execu|reloc|shell|libr|data|obj|text'`" ]; then
++				if [ -n "`echo \"${FTYPE}\" | grep -v -i 'compres' | grep -i 'execu|reloc|shell|libr|data|obj|text'`" ]; then
+ 					FOUND=1
+ 					SUSPSCAN_NUM=1; SUSPSCAN_SCORE=0; SUSPSCAN_HITCOUNT=0
+ 					SUSPSCAN_STRINGS=""
+@@ -13144,7 +13144,7 @@
+ 	FOUND=0
+ 
+ 	if [ -n "${KSYMS_FILE}" ]; then
+-		egrep -i 'adore|sebek' "${KSYMS_FILE}" >/dev/null 2>&1 && FOUND=1
++		grep -i 'adore|sebek' "${KSYMS_FILE}" >/dev/null 2>&1 && FOUND=1
+ 	fi
+ 
+ 	if [ $FOUND -eq 0 ]; then
+@@ -14054,7 +14054,7 @@
+ 
+ 								FNAMEGREP=`echo "${FNAMEGREP}" | sed -e 's/^|//;'`
+ 
+-								if [ -n "`echo \"${FNAME}\" | egrep \"^(${FNAMEGREP})$\"`" ]; then
++								if [ -n "`echo \"${FNAME}\" | grep \"^(${FNAMEGREP})$\"`" ]; then
+ 									PROCWHITELISTED=1
+ 								fi
+ 							else
+@@ -14167,7 +14167,7 @@
+ 			RKHLSOF_FILE="${TEMPFILE}"
+ 			touch "${RKHLSOF_FILE}"
+ 
+-			${LSOF_CMD} -wnlP +c 0 2>&1 | egrep -v ' (FIFO|V?DIR|IPv[46]) ' | sort | uniq >"${RKHLSOF_FILE}"
++			${LSOF_CMD} -wnlP +c 0 2>&1 | grep -v ' (FIFO|V?DIR|IPv[46]) ' | sort | uniq >"${RKHLSOF_FILE}"
+ 
+ 			#
+ 			# Now loop through the known suspicious filenames,
+@@ -14369,7 +14369,7 @@
+ 				ROOTKIT_COUNT=`expr $ROOTKIT_COUNT + 1`
+ 
+ 				SEEN=1
+-				FOUND_PROCS=`${UNHIDE_CMD} ${UNHIDE_OPTS} ${RKHTMPVAR} 2>&1 | egrep -v '^(Unhide |yjesus@|http:|Copyright |License |NOTE :|Used options:|\[\*\]|$)'`
++				FOUND_PROCS=`${UNHIDE_CMD} ${UNHIDE_OPTS} ${RKHTMPVAR} 2>&1 | grep -v '^(Unhide |yjesus@|http:|Copyright |License |NOTE :|Used options:|\[\*\]|$)'`
+ 
+ 				if [ -z "${FOUND_PROCS}" ]; then
+ 					# Nothing found.
+@@ -14950,7 +14950,7 @@
+ 			IFS=$IFSNL
+ 
+ 			# Get the default enabled services.
+-			for LINE in `egrep '^[ 	]*enabled[ 	]*\+?=' "${FILENAME}"`; do
++			for LINE in `grep '^[ 	]*enabled[ 	]*\+?=' "${FILENAME}"`; do
+ 				SEEN=1
+ 
+ 				RKHTMPVAR=`echo "${LINE}" | sed -e 's/^.*=//' | tr -s '	' ' '`
+@@ -14968,7 +14968,7 @@
+ 
+ 
+ 			# Get the default disabled services.
+-			for LINE in `egrep '^[ 	]*disabled[ 	]*\+?=' "${FILENAME}"`; do
++			for LINE in `grep '^[ 	]*disabled[ 	]*\+?=' "${FILENAME}"`; do
+ 				RKHTMPVAR=`echo "${LINE}" | sed -e 's/^.*=//' | tr -s '	' ' '`
+ 
+ 				XINETD_DFLTS_DISABLED="${XINETD_DFLTS_DISABLED} ${RKHTMPVAR}"
+@@ -15017,14 +15017,14 @@
+ 			#
+ 
+ 			if [ -n "${XINETD_DFLTS_ENABLED}" ]; then
+-				if [ -n "`echo \"${XINETD_DFLTS_ENABLED}\" | egrep \"${SVCID}\"`" ]; then
+-					if [ -z "`echo \"${XINETD_DFLTS_DISABLED}\" | egrep \"${SVCID}\"`" ]; then
++				if [ -n "`echo \"${XINETD_DFLTS_ENABLED}\" | grep \"${SVCID}\"`" ]; then
++					if [ -z "`echo \"${XINETD_DFLTS_DISABLED}\" | grep \"${SVCID}\"`" ]; then
+ 						SEEN=1
+ 						IFS=$IFSNL
+ 						break
+ 					fi
+ 				fi
+-			elif [ -n "`echo \"${XINETD_DFLTS_DISABLED}\" | egrep \"${SVCID}\"`" ]; then
++			elif [ -n "`echo \"${XINETD_DFLTS_DISABLED}\" | grep \"${SVCID}\"`" ]; then
+ 				:
+ 			elif [ -z "`echo $DATA | grep 'disable = yes'`" ]; then
+ 				SEEN=1
+@@ -15361,7 +15361,7 @@
+ 			test -f "${DIR}/mod_rootme2.so" && FOUNDFILES="${FOUNDFILES} ${DIR}/mod_rootme2.so"
+ 
+ 			if [ -f "${DIR}/httpd.conf" ]; then
+-				if [ -n "`egrep 'mod_rootme2?\.so' \"${DIR}/httpd.conf\"`" ]; then
++				if [ -n "`grep 'mod_rootme2?\.so' \"${DIR}/httpd.conf\"`" ]; then
+ 					FOUNDFILES="${FOUNDFILES} ${DIR}/httpd.conf"
+ 				fi
+ 			fi
+@@ -15664,7 +15664,7 @@
+ 		${FIND_CMD} "${LKM_PATH}" -type f -a \( -name "*.o" -o -name "*.ko" -o -name "*.ko.xz" \) >"${TEMPFILE}" 2>/dev/null
+ 
+ 		for RKHTMPVAR in ${LKM_NAMES}; do
+-			if [ -n "`egrep \"/${RKHTMPVAR}(\.xz)?$\" "${TEMPFILE}"`" ]; then
++			if [ -n "`grep \"/${RKHTMPVAR}(\.xz)?$\" "${TEMPFILE}"`" ]; then
+ 				FOUND=1
+ 				FOUNDFILES="${FOUNDFILES} ${RKHTMPVAR}"
+ 			fi
+@@ -15814,10 +15814,10 @@
+ 			if [ -n "`echo \"${LSOFLINE}\" | grep \" ${PROTO} \*:${PORT} \"`" ]; then
+ 				# Process listening for connections from anywhere.
+ 				PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'`
+-			elif [ -n "`echo \"${LSOFLINE}\" | egrep \" ${PROTO} [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:${PORT}[ -]\"`" ]; then
++			elif [ -n "`echo \"${LSOFLINE}\" | grep \" ${PROTO} [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:${PORT}[ -]\"`" ]; then
+ 				# Established or listening process using IPv4 address.
+ 				PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'`
+-			elif [ -n "`echo \"${LSOFLINE}\" | egrep \" ${PROTO} \[[:0-9a-fA-F]+\]:${PORT}[ -]\"`" ]; then
++			elif [ -n "`echo \"${LSOFLINE}\" | grep \" ${PROTO} \[[:0-9a-fA-F]+\]:${PORT}[ -]\"`" ]; then
+ 				# Established or listening process using IPv6 address.
+ 				PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'`
+ 			else
+@@ -15879,7 +15879,7 @@
+ 			if [ "${PROTO}" = "UDP" ]; then
+ 				FOUND=`${NETSTAT_CMD} -an | grep -i "^udp.*\.${PORT} " | ${AWK_CMD} '{ print $4 }' | grep "\.${PORT}$"`
+ 			elif [ "${PROTO}" = "TCP" ]; then
+-				FOUND=`${NETSTAT_CMD} -an | egrep -i "^tcp.*\.${PORT} .*(BOUND|ESTABLISH|LISTEN)" | ${AWK_CMD} '{ print $4 }' | grep "\.${PORT}$"`
++				FOUND=`${NETSTAT_CMD} -an | grep -i "^tcp.*\.${PORT} .*(BOUND|ESTABLISH|LISTEN)" | ${AWK_CMD} '{ print $4 }' | grep "\.${PORT}$"`
+ 			fi
+ 			;;
+ 		SunOS)
+@@ -15890,10 +15890,10 @@
+ 					FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^UDP: IPv6/, /^$/ { print $1 }' | grep "\.${PORT}$"`
+ 				fi
+ 			elif [ "${PROTO}" = "TCP" ]; then
+-				FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv4/, /^$/ { print $0 }' | egrep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"`
++				FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv4/, /^$/ { print $0 }' | grep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"`
+ 
+ 				if [ -z "${FOUND}" ]; then
+-					FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv6/, /^$/ { print $0 }' | egrep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"`
++					FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv6/, /^$/ { print $0 }' | grep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"`
+ 				fi
+ 			fi
+ 			;;
+@@ -16428,7 +16428,7 @@
+ 	WHITEPROC=""
+ 	BLACKPROC=""
+ 
+-	LIBPCAPRES=`egrep -v '(^sk | 888e )' /proc/net/packet 2>/dev/null | head ${HEAD_OPT}1`
++	LIBPCAPRES=`grep -v '(^sk | 888e )' /proc/net/packet 2>/dev/null | head ${HEAD_OPT}1`
+ 
+ 	if [ -n "${LIBPCAPRES}" ]; then
+ 		ALLOWPROCLISTENERS=""
+@@ -16444,7 +16444,7 @@
+ 
+ 		INODE_LIST=""
+ 
+-		for INODE in `egrep -v '(^sk | 888e )' /proc/net/packet | ${AWK_CMD} '{ print $9 }'`; do
++		for INODE in `grep -v '(^sk | 888e )' /proc/net/packet | ${AWK_CMD} '{ print $9 }'`; do
+ 			INODE_LIST="${INODE_LIST}|$INODE"
+ 		done
+ 
+@@ -16452,7 +16452,7 @@
+ 		test -z "${INODE_LIST}" && INODE_LIST="RKHunterPktCapture"
+ 
+ 
+-		for PID in `${LSOF_CMD} -lMnPw -d 1-20 2>/dev/null | egrep "[ 	](pack[ 	]+(${INODE_LIST})|sock[ 	]+[^ 	]+[ 	]+[^ 	]+[ 	]+(${INODE_LIST}))[ 	]" | ${AWK_CMD} '{ print $2 }'`; do
++		for PID in `${LSOF_CMD} -lMnPw -d 1-20 2>/dev/null | grep "[ 	](pack[ 	]+(${INODE_LIST})|sock[ 	]+[^ 	]+[ 	]+[^ 	]+[ 	]+(${INODE_LIST}))[ 	]" | ${AWK_CMD} '{ print $2 }'`; do
+ 			NAME=""
+ 
+ 			if [ -h "/proc/$PID/exe" -a $HAVE_READLINK -eq 1 ]; then
+@@ -16670,7 +16670,7 @@
+ 			RKHTMPVAR=`grep "${STRING}" "${FNAME}"`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+-				test -z "`echo \"${RKHTMPVAR}\" | egrep -v '^[ 	]*#'`" && continue
++				test -z "`echo \"${RKHTMPVAR}\" | grep -v '^[ 	]*#'`" && continue
+ 
+ 				if [ -n "`echo \"${RTKT_FILE_WHITELIST}\" | grep \"^${FNAMEGREP}:${STRING}$\"`" ]; then
+ 					if [ $VERBOSE_LOGGING -eq 1 ]; then
+@@ -16944,7 +16944,7 @@
+ 			if [ -n "${DSCL_CMD}" ]; then
+ 				display --to LOG --type INFO FOUND_CMD 'dscl' "${DSCL_CMD}"
+ 
+-				RKHTMPVAR2=`${DSCL_CMD} . search /Users uid 0 | egrep '^[^ 	)]' | cut -d'	' -f1`
++				RKHTMPVAR2=`${DSCL_CMD} . search /Users uid 0 | grep '^[^ 	)]' | cut -d'	' -f1`
+ 			else
+ 				display --to LOG --type INFO NOT_FOUND_CMD 'dscl'
+ 			fi
+@@ -17525,7 +17525,7 @@
+ 
+ 			test $SUNOS -eq 1 -o $IRIXOS -eq 1 && PS_ARGS="-ef"
+ 
+-			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep '(syslogd|syslog-ng)( |$)' | grep -v 'egrep'`
++			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep '(syslogd|syslog-ng)( |$)' | grep -v 'grep'`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+ 				SYSLOG_SEEN=1
+@@ -17545,7 +17545,7 @@
+ 				TITLE_SHOWN=1
+ 			fi
+ 
+-			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep 'systemd-journald( |$)' | grep -v 'egrep'`
++			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep 'systemd-journald( |$)' | grep -v 'grep'`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+ 				SYSTEMD_SEEN=1
+@@ -17561,7 +17561,7 @@
+ 				TITLE_SHOWN=1
+ 			fi
+ 
+-			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep 'metalog( |$)' | grep -v 'egrep'`
++			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep 'metalog( |$)' | grep -v 'grep'`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+ 				METALOG_SEEN=1
+@@ -17577,7 +17577,7 @@
+ 				TITLE_SHOWN=1
+ 			fi
+ 
+-			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep 'socklog( |$)' | grep -v 'egrep'`
++			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep 'socklog( |$)' | grep -v 'grep'`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+ 				SOCKLOG_SEEN=1
+@@ -17638,7 +17638,7 @@
+ 					RKHTMPVAR="an"
+ 				elif [ -n "`echo \"${FNAME}\" | grep '/syslog-ng\.conf$'`" ]; then
+ 					FTYPE="syslog-ng"
+-				elif [ -n "`echo \"${FNAME}\" | egrep '/(systemd-)?journald\.conf$'`" ]; then
++				elif [ -n "`echo \"${FNAME}\" | grep '/(systemd-)?journald\.conf$'`" ]; then
+ 					FTYPE="systemd"
+ 				else
+ 					FTYPE="syslog"
+@@ -17656,15 +17656,15 @@
+ 				if [ "${FTYPE}" != "systemd" ]; then
+ 					RKHTMPVAR=""
+ 
+-					if [ -n "`echo \"${FNAME}\" | egrep '/r?syslog\.conf$'`" ]; then
+-						RKHTMPVAR=`egrep -i '^[^#].*[ 	](@|:omrelp:).' "${FNAME}" | egrep -i -v '(@|:omrelp:)127\.'`
++					if [ -n "`echo \"${FNAME}\" | grep '/r?syslog\.conf$'`" ]; then
++						RKHTMPVAR=`grep -i '^[^#].*[ 	](@|:omrelp:).' "${FNAME}" | grep -i -v '(@|:omrelp:)127\.'`
+ 					else
+ 						#
+ 						# For syslog-ng we must look for a destination
+ 						# block which uses TCP or UDP.
+ 						#
+ 
+-						RKHTMPVAR=`${AWK_CMD} '/^[ 	]*destination( |	|$)/, /}/ { print $0 }' "${FNAME}" | egrep -i '( |	|\{|^)(tcp|udp)6?( |	|\(|$)' | egrep -v -i '(tcp|udp)6?[ 	]*\([ 	]*("[ 	]*)?127\.'`
++						RKHTMPVAR=`${AWK_CMD} '/^[ 	]*destination( |	|$)/, /}/ { print $0 }' "${FNAME}" | grep -i '( |	|\{|^)(tcp|udp)6?( |	|\(|$)' | grep -v -i '(tcp|udp)6?[ 	]*\([ 	]*("[ 	]*)?127\.'`
+ 					fi
+ 
+ 					if [ -n "${RKHTMPVAR}" ]; then
+@@ -17680,7 +17680,7 @@
+ 			# that the warnings are shown before anything else.
+ 			#
+ 
+-			if [ $SYSLOG_SEEN -eq 1 -a -z "`echo \"${FILEFOUND}\" | egrep ' (syslog|rsyslog|syslog-ng) '`" ]; then
++			if [ $SYSLOG_SEEN -eq 1 -a -z "`echo \"${FILEFOUND}\" | grep ' (syslog|rsyslog|syslog-ng) '`" ]; then
+ 				display --to SCREEN+LOG --type PLAIN --result WARNING --color RED --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_FILE
+ 				display --to LOG --type WARNING SYSTEM_CONFIGS_SYSLOG_NO_FILE 'syslog'
+ 			elif [ $SYSTEMD_SEEN -eq 1 -a -z "`echo \"${FILEFOUND}\" | grep ' systemd '`" ]; then
+@@ -17696,7 +17696,7 @@
+ 			# We only display the remote logging result if a configuration file was found.
+ 			#
+ 
+-			if [ -n "`echo \"${FILEFOUND}\" | egrep ' (syslog|rsyslog|syslog-ng) '`" ]; then
++			if [ -n "`echo \"${FILEFOUND}\" | grep ' (syslog|rsyslog|syslog-ng) '`" ]; then
+ 				if [ $ALLOW_SYSLOG_REMOTE_LOGGING -eq 1 ]; then
+ 					display --to SCREEN+LOG --type PLAIN --result ALLOWED --color GREEN --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_SYSLOG_REMOTE
+ 				elif [ $REM_LOGGING_FOUND -eq 0 ]; then
+@@ -17733,7 +17733,7 @@
+ 		FTYPE=`echo "${FTYPE}" | tail ${TAIL_OPT}1`
+ 	fi
+ 
+-	if [ -z "`echo \"${FTYPE}\" | egrep -v '(character special|block special|socket|fifo \(named pipe\)|symbolic link to|empty|directory|/MAKEDEV:)'`" ]; then
++	if [ -z "`echo \"${FTYPE}\" | grep -v '(character special|block special|socket|fifo \(named pipe\)|symbolic link to|empty|directory|/MAKEDEV:)'`" ]; then
+ 		return
+ 	fi
+ 
+@@ -17831,7 +17831,7 @@
+ 			RKHTMPVAR=`find_cmd mount`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+-				test -n "`${RKHTMPVAR} 2>/dev/null | egrep '^fdesc(fs)? .*(type fdesc|\(fdescfs\))'`" && FDESCFS=1
++				test -n "`${RKHTMPVAR} 2>/dev/null | grep '^fdesc(fs)? .*(type fdesc|\(fdescfs\))'`" && FDESCFS=1
+ 			else
+ 				display --to LOG --type INFO NOT_FOUND_CMD 'mount'
+ 			fi
+@@ -17929,7 +17929,7 @@
+ 
+ 	for DIR in ${SHORTSEARCHDIRS}; do
+ 		if [ -d "${DIR}" ]; then
+-			RKHTMPVAR=`ls -1d ${DIR}/.* 2>/dev/null | egrep -v '/\.\.?$'`
++			RKHTMPVAR=`ls -1d ${DIR}/.* 2>/dev/null | grep -v '/\.\.?$'`
+ 			test -n "${RKHTMPVAR}" && LOOKINDIRS="${LOOKINDIRS}
+ ${RKHTMPVAR}"
+ 		fi
+@@ -17971,7 +17971,7 @@
+ 
+ 		FTYPE=`${FILE_CMD} "${FNAME}" 2>&1 | ${AWK_CMD} -F':' '{ print $NF }' | cut -c2-`
+ 
+-		test -n "`echo \"${FTYPE}\" | egrep 'character special|block special|empty'`" && continue
++		test -n "`echo \"${FTYPE}\" | grep 'character special|block special|empty'`" && continue
+ 
+ 		FNAMEGREP=`echo "${FNAME}" | sed -e 's/\([.$*?\\]\)/\\\\\1/g; s/\[/\\\\[/g; s/\]/\\\\]/g'`
+ 
+@@ -18312,7 +18312,7 @@
+ 				;;
+ 			named)
+ 				WHOLE_VERSION=`${APP_CMD_FOUND} -v 2>/dev/null`
+-				VERSION=`echo "${WHOLE_VERSION}" | egrep '^(named|BIND)[ 	][ 	]*[0-9]' | grep -v '/' | ${AWK_CMD} '{ print $2 }'`
++				VERSION=`echo "${WHOLE_VERSION}" | grep '^(named|BIND)[ 	][ 	]*[0-9]' | grep -v '/' | ${AWK_CMD} '{ print $2 }'`
+ 
+ 				if [ -n "`echo \"${VERSION}\" | grep '^[^-]*\.[0-9][0-9]*-P[^-]*-'`" ]; then
+ 					VERSION=`echo "${VERSION}" | cut -d'-' -f1-2`
+@@ -18376,7 +18376,7 @@
+ 			if [ -n "`echo \"${APP_WHITELIST}\" | grep -i \" ${APPLICATION}:${RKHTMPVAR} \"`" ]; then
+ 				APP_RESULTS="${APP_RESULTS}
+ ${APPLICATION}%${APPLICATION_DESC}%${VERSION}%-1"
+-			elif [ -n "`egrep -i \"^${APPLICATION}:.* ${RKHTMPVAR}( |$)\" \"${DB_PATH}/programs_bad.dat\" 2>&1`" ]; then
++			elif [ -n "`grep -i \"^${APPLICATION}:.* ${RKHTMPVAR}( |$)\" \"${DB_PATH}/programs_bad.dat\" 2>&1`" ]; then
+ 				APPS_FAILED_COUNT=`expr ${APPS_FAILED_COUNT} + 1`
+ 
+ 				APP_RESULTS="${APP_RESULTS}
+@@ -19009,7 +19009,7 @@
+ 
+ 	PROP_FILE_LIST="adduser amd awk basename bash bget cat chattr checkproc
+ 	    chkconfig chmod chown chroot cp cron csh curl cut date depmod df
+-	    diff dirname dmesg dpkg dpkg-query du echo ed egrep elinks env fgrep
++	    diff dirname dmesg dpkg dpkg-query du echo ed grep elinks env fgrep
+ 	    file find fsck fuser GET grep groupadd groupdel groupmod groups grpck head id
+ 	    ifconfig ifdown ifstatus ifup inetd init insmod ip ipcs kallsyms kill
+ 	    killall ksyms kudzu last lastlog ldd less links locate logger login
+@@ -19031,7 +19031,7 @@
+ 	SunOS)
+ 		PROP_FILE_LIST="${PROP_FILE_LIST} gawk gbasename gcat gchmod gchown
+ 				gcksum gcp gcut gdate gdiff gdiff3 gdirname gdu gecho
+-				gegrep genv gfile gfind ggrep ggroups ghead gid glocate
++				ggrep genv gfile gfind ggrep ggroups ghead gid glocate
+ 				gls gmd5sum gmv gpwd gsed gsize gsort gstrings gsum
+ 				gtail gtest gtouch guname guniq gusers gwc gwho gwhoami
+ 				inetadm nawk truss unhide unhide-posix unhide-tcp"
+@@ -19792,8 +19792,8 @@
+ # required commands are tested early on using just the root PATH. Then
+ # BINDIR is checked, and finally the rest of the commands are then
+ # checked using the new PATH from BINDIR.
+-ABSOLUTELY_REQUIRED_CMDS="cut egrep grep sed tail tr"
+-REQCMDS="awk cat chmod chown cp cut date egrep grep head ls mv sed sort tail touch tr uname uniq wc"
++ABSOLUTELY_REQUIRED_CMDS="cut grep grep sed tail tr"
++REQCMDS="awk cat chmod chown cp cut date grep grep head ls mv sed sort tail touch tr uname uniq wc"
+ 
+ # This will be set to a list of commands that have been disabled.
+ DISABLED_CMDS=""
+@@ -20903,10 +20903,10 @@
+ 	#
+ 
+ 	if [ -z "${PRELINK_HASH}" ]; then
+-		if [ -z "`echo \"${HASH_FUNC}\" | egrep '(/filehashsha\.pl Digest::MD5|/filehashsha\.pl .* 1$|shasum -a 1$)'`" ]; then
++		if [ -z "`echo \"${HASH_FUNC}\" | grep '(/filehashsha\.pl Digest::MD5|/filehashsha\.pl .* 1$|shasum -a 1$)'`" ]; then
+ 			RKHTMPVAR=`echo "${HASH_FUNC}" | cut -d' ' -f1`
+ 
+-			if [ -z "`echo ${RKHTMPVAR} | egrep -i 'sha1|md5'`" ]; then
++			if [ -z "`echo ${RKHTMPVAR} | grep -i 'sha1|md5'`" ]; then
+ 				if [ $HASH_OPT -eq 1 ]; then
+ 					echo "This system uses prelinking, but the '--hash' option (${HASH_FUNC}) does not look like SHA1 or MD5."
+ 				else
+@@ -21014,7 +21014,7 @@
+ #
+ IFS=$IFSNL
+ 
+-for LINE in `egrep '^MSG_(TYPE|RESULT)_' "${DB_PATH}/i18n/en" 2>/dev/null`; do
++for LINE in `grep '^MSG_(TYPE|RESULT)_' "${DB_PATH}/i18n/en" 2>/dev/null`; do
+ 	TYPE=`echo "${LINE}" | cut -d: -f1`
+ 
+ 	if [ "${LANGUAGE}" != "en" ]; then
+@@ -21219,7 +21219,7 @@
+ 			fi
+ 		elif [ -n "${PRELINK_HASH}" ]; then
+ 			display --to LOG --type INFO HASH_FUNC_PRELINK "${PRELINK_HASH}"
+-		elif [ -z "`echo \"${HASH_FUNC}\" | egrep -i 'sha1|md5'`" ]; then
++		elif [ -z "`echo \"${HASH_FUNC}\" | grep -i 'sha1|md5'`" ]; then
+ 			SKIP_HASH_MSG=1
+ 		else
+ 			display --to LOG --type INFO HASH_FUNC "${HASH_FUNC}"
diff --git a/rkhunter.spec b/rkhunter.spec
index 993a921..be0b81e 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        19%{?dist}
+Release:        20%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -16,6 +16,8 @@ Patch0:         rkhunter-1.4.6-fedoraconfig.patch
 Patch1:         rkhunter-1.4.6-drop-libkeyutils-check.patch
 # have ssh checks use the sshd.d directoy config files too.
 Patch2:         rkhunter-1.4.6-ssh.d.patch
+# Fix grep/egrep changes in f38+
+Patch3:         rkhunter-1.4.6-grep.patch
 BuildArch:      noarch
 BuildRequires:      perl-generators
 
@@ -98,6 +100,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Mon Apr 10 2023 Kevin Fenzi <kevin@scrye.com> - 1.4.6-20
+- Patch grep/egrep changes to avoid warnings in F38+
+
 * Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-19
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
 

From 0054f1e6a10fb3896618254505c043f21bb93870 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 29 Apr 2023 10:26:27 -0700
Subject: [PATCH 112/122] More complete fix for egrep changes.

---
 rkhunter-1.4.6-grep.patch | 705 +-------------------------------------
 rkhunter.spec             |   5 +-
 2 files changed, 18 insertions(+), 692 deletions(-)

diff --git a/rkhunter-1.4.6-grep.patch b/rkhunter-1.4.6-grep.patch
index 8331ccf..fb249b5 100644
--- a/rkhunter-1.4.6-grep.patch
+++ b/rkhunter-1.4.6-grep.patch
@@ -1,6 +1,6 @@
 diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
---- rkhunter-1.4.6.orig/files/rkhunter	2023-04-10 10:44:16.226859554 -0700
-+++ rkhunter-1.4.6/files/rkhunter	2023-04-20 17:57:11.365373544 -0700
+--- rkhunter-1.4.6.orig/files/rkhunter	2023-04-29 09:32:39.288709203 -0700
++++ rkhunter-1.4.6/files/rkhunter	2023-04-29 10:00:29.396271053 -0700
 @@ -70,7 +70,7 @@
  # we exec to log everything to the debug file.
  #
@@ -10,703 +10,26 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunt
  	RKHDEBUGFILE=""
  	RKHDEBUGBASE="/tmp/rkhunter-debug"
  
-@@ -181,9 +181,9 @@
+@@ -181,9 +181,11 @@
  # used. If it is, then some typical grep tests will fail.
  #
  
 -if [ "`echo \"rkh-grep-test\" | grep '^\+'`" = "rkh-grep-test" ]; then
++# fedora always uses POSIX grep and set an alias here for depreciated egrep too
 +#if [ "`echo \"rkh-grep-test\" | grep '^\+'`" = "rkh-grep-test" ]; then
  	alias grep='grep -E'
 -fi
++	alias egrep='grep -E'
 +#fi
  
  
  #
-@@ -948,9 +948,9 @@
- 		#
- 
- 		if [ "${OPT_NAME}" = "SHARED_LIB_WHITELIST" ]; then
--			RKHTMPVAR=`echo "${OPT_VALUE}" | egrep '(^|[^\\])[][?*]'`
-+			RKHTMPVAR=`echo "${OPT_VALUE}" | grep '(^|[^\\])[][?*]'`
- 		else
--			RKHTMPVAR=`echo "${OPT_VALUE}" | egrep '(^|[^\\])[][?*{}]'`
-+			RKHTMPVAR=`echo "${OPT_VALUE}" | grep '(^|[^\\])[][?*{}]'`
- 		fi
- 
- 		if [ -n "${RKHTMPVAR}" ]; then
-@@ -1000,7 +1000,7 @@
- 		# Also check that '/' has not been set.
- 		#
- 
--		if [ -n "`echo \"${FNAME}\" | egrep '(^[./]*$)|[;&]|/\.\./'`" ]; then
-+		if [ -n "`echo \"${FNAME}\" | grep '(^[./]*$)|[;&]|/\.\./'`" ]; then
- 			ERRCODE=1
- 
- 			echo "Invalid ${OPT_NAME} configuration option: Invalid pathname: ${FNAME}"
-@@ -1134,7 +1134,7 @@
- 				#
- 
- 				if [ "${OPT_NAME}" = "SHARED_LIB_WHITELIST" ]; then
--					if [ -n "`echo \"${FNAME}\" | egrep '\\$\\{?(ORIGIN|LIB|PLATFORM)\\}?'`" ]; then
-+					if [ -n "`echo \"${FNAME}\" | grep '\\$\\{?(ORIGIN|LIB|PLATFORM)\\}?'`" ]; then
- 						continue
- 					fi
- 				fi
-@@ -3848,7 +3848,7 @@
- 		#
- 
- 		for RKHTMPVAR2 in ${RKHTMPVAR}; do
--			if [ -n "`echo \"${RKHTMPVAR2}\" | egrep -i '^(TCP|UDP):[1-9][0-9]*$'`" ]; then
-+			if [ -n "`echo \"${RKHTMPVAR2}\" | grep -i '^(TCP|UDP):[1-9][0-9]*$'`" ]; then
- 				PROTO=`echo ${RKHTMPVAR2} | cut -d: -f1 | tr '[:lower:]' '[:upper:]'`
- 				PORT=`echo ${RKHTMPVAR2} | cut -d: -f2`
- 
-@@ -3899,7 +3899,7 @@
- 				PROTO=""
- 
- 				# Dig out the protocol and port number, if present.
--				if [ -n "`echo \"${RKHTMPVAR2}\" | egrep -i '.:(TCP|UDP):[1-9][0-9]*$'`" ]; then
-+				if [ -n "`echo \"${RKHTMPVAR2}\" | grep -i '.:(TCP|UDP):[1-9][0-9]*$'`" ]; then
- 					PROTO=`echo "${RKHTMPVAR2}" | sed -e 's/^.*:\([a-zA-Z]*\):[1-9][0-9]*$/\1/'`
- 					PORT=`echo "${RKHTMPVAR2}" | sed -e 's/^.*:\([1-9][0-9]*\)$/\1/'`
- 
-@@ -4839,7 +4839,7 @@
- 		fi
- 	fi
- 
--	if [ -n "`echo \"${HASH_FUNC}\" | egrep -i '^(MD5|SHA1|SHA224|SHA256|SHA384|SHA512|RIPEMD160|WHIRLPOOL|NONE)$'`" ]; then
-+	if [ -n "`echo \"${HASH_FUNC}\" | grep -i '^(MD5|SHA1|SHA224|SHA256|SHA384|SHA512|RIPEMD160|WHIRLPOOL|NONE)$'`" ]; then
- 		HASH_FUNC=`echo "${HASH_FUNC}" | tr '[:lower:]' '[:upper:]'`
- 	fi
- 
-@@ -6412,7 +6412,7 @@
- 		OSNAME="${OSNAME} `sw_vers 2>/dev/null | grep '^ProductVersion:' | sed -e 's/ProductVersion:[ 	]*//'`"
- #		OSNAME="${OSNAME} `sysctl kern.version 2>/dev/null | sed -e 's/^kern.version = //' | cut -d: -f1`"
- 
--		if [ -n "`sysctl -a 2>/dev/null | egrep '^(hw\.optional\.x86_64|hw\.optional\.64bitops|hw\.cpu64bit_capable).*1$'`" ]; then
-+		if [ -n "`sysctl -a 2>/dev/null | grep '^(hw\.optional\.x86_64|hw\.optional\.64bitops|hw\.cpu64bit_capable).*1$'`" ]; then
- 			OSNAME="${OSNAME} (64-bit capable)"
- 		fi
- 		;;
-@@ -6708,7 +6708,7 @@
- 						# this is what RPM does).
- 						#
- 
--						RPM_QUERY_RESULT=`echo "${RPM_QUERY_RESULT_ARCH}" | egrep ':(x86_64|ia64):' 2>/dev/null | tail ${TAIL_OPT}1`
-+						RPM_QUERY_RESULT=`echo "${RPM_QUERY_RESULT_ARCH}" | grep ':(x86_64|ia64):' 2>/dev/null | tail ${TAIL_OPT}1`
- 
- 						test -z "${RPM_QUERY_RESULT}" && RPM_QUERY_RESULT=`echo "${RPM_QUERY_RESULT_ARCH}" | tail ${TAIL_OPT}1`
- 
-@@ -6883,7 +6883,7 @@
- 					if [ -n "${PKGNAME}" ]; then
- 						if [ -f "/var/lib/dpkg/info/${PKGNAME}.md5sums" ]; then
- 							FILNAM=`echo "${FNAME}" | sed -e 's:^/::; s:\.:\\\.:g'`
--							SYSHASH=`egrep "( |\./)${FILNAM}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" 2>/dev/null | cut -d' ' -f1`
-+							SYSHASH=`grep "( |\./)${FILNAM}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" 2>/dev/null | cut -d' ' -f1`
- 							test -n "${SYSHASH}" && FILE_IS_PKGD=1
- 						fi
- 					fi
-@@ -6925,7 +6925,7 @@
- 					SYSHASH=""
- 					RKHTMPVAR=`${HASH_CMD} "${FNAME}" 2>&1`
- 
--					if [ -n "`echo \"${RKHTMPVAR}\" | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
-+					if [ -n "`echo \"${RKHTMPVAR}\" | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
- 						DEPENDENCY_ERR=1
- 						RKHTMPVAR=`echo "${RKHTMPVAR}" | tr '\n' ':' | sed -e 's/:$//'`
- 					else
-@@ -7311,13 +7311,13 @@
- 
- 	case $MIRRORS_MODE in
- 	0)
--		MIRROR=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
-+		MIRROR=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
- 		;;
- 	1)
--		MIRROR=`egrep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
-+		MIRROR=`grep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
- 		;;
- 	2)
--		MIRROR=`egrep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
-+		MIRROR=`grep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
- 		;;
- 	esac
- 
-@@ -7337,13 +7337,13 @@
- 
- 		case $MIRRORS_MODE in
- 		0)
--			MIRROR=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
-+			MIRROR=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
- 			;;
- 		1)
--			MIRROR=`egrep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
-+			MIRROR=`grep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
- 			;;
- 		2)
--			MIRROR=`egrep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
-+			MIRROR=`grep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
- 			;;
- 		esac
- 
-@@ -7370,7 +7370,7 @@
- 	# Next get the remaining mirrors.
- 	#
- 
--	OTHERMIRRORS=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | grep -v "^${MIRROR}\$"`
-+	OTHERMIRRORS=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | grep -v "^${MIRROR}\$"`
- 
- 
- 	#
-@@ -7459,13 +7459,13 @@
- 
- 		case $MIRRORS_MODE in
- 		0)
--			MIRROR_COUNT=`egrep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
-+			MIRROR_COUNT=`grep -i '^(local|remote|mirror)=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
- 			;;
- 		1)
--			MIRROR_COUNT=`egrep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
-+			MIRROR_COUNT=`grep -i '^local=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
- 			;;
- 		2)
--			MIRROR_COUNT=`egrep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
-+			MIRROR_COUNT=`grep -i '^remote=https?://[-A-Za-z0-9\+@#/%=_:,.]*[-A-Za-z0-9\+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
- 			;;
- 		esac
- 
-@@ -7991,7 +7991,7 @@
- 	# Now check to see if any unknown options have been configured.
- 	#
- 
--	RKHTMPVAR=`egrep -h -v '^[ 	]*(#|$)' ${CONFIGFILE} ${LOCALCONFIGFILE} ${LOCALCONFDIRFILES}`
-+	RKHTMPVAR=`grep -h -v '^[ 	]*(#|$)' ${CONFIGFILE} ${LOCALCONFIGFILE} ${LOCALCONFDIRFILES}`
- 
- 	IFS=$IFSNL
- 
-@@ -10705,7 +10705,7 @@
- 		done
- 
- 
--		if [ -n "`echo \"${RKHTMPVAR}\" | egrep 'libsafe|missing|empty'`" ]; then
-+		if [ -n "`echo \"${RKHTMPVAR}\" | grep 'libsafe|missing|empty'`" ]; then
- 			display --to LOG --type WARNING --nl PROPUPD_WARN
- 		fi
- 
-@@ -10957,7 +10957,7 @@
- 
- 						FILE_IS_PKGD=1
- 
--						PKGNAME=`echo "${PKGNAME_ARCH}" | egrep '\.(x86_64|ia64)$' 2>/dev/null | tail ${TAIL_OPT}1`
-+						PKGNAME=`echo "${PKGNAME_ARCH}" | grep '\.(x86_64|ia64)$' 2>/dev/null | tail ${TAIL_OPT}1`
- 
- 						test -z "${PKGNAME}" && PKGNAME=`echo "${PKGNAME_ARCH}" | tail ${TAIL_OPT}1`
- 
-@@ -11156,7 +11156,7 @@
- 					if [ -n "${PKGNAME}" -a -f "/var/lib/dpkg/info/${PKGNAME}.md5sums" ]; then
- 						FNGREP=`echo "${FNAMEGREP}" | sed -e 's:^/::'`
- 
--						SYSHASH=`egrep "( |\./)${FNGREP}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" | cut -d' ' -f1`
-+						SYSHASH=`grep "( |\./)${FNGREP}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" | cut -d' ' -f1`
- 
- 						if [ -n "${SYSHASH}" ]; then
- 							FILE_IS_PKGD=1
-@@ -11165,7 +11165,7 @@
- 							if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then
- 								PKGMGR_VERIFY_RESULT="5"
- 
--								if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
-+								if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
- 									DEPENDENCY_ERR=1
- 								fi
- 							fi
-@@ -11214,7 +11214,7 @@
- 							if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then
- 								PKGMGR_VERIFY_RESULT="5"
- 
--								if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
-+								if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
- 									DEPENDENCY_ERR=1
- 								fi
- 							fi
-@@ -11245,7 +11245,7 @@
- 							if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then
- 								PKGMGR_VERIFY_RESULT="5"
- 
--								if [ -n "`${PKGMGR_SHA_HASH} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
-+								if [ -n "`${PKGMGR_SHA_HASH} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
- 									DEPENDENCY_ERR=1
- 								fi
- 							fi
-@@ -11288,7 +11288,7 @@
- 						fi
- 					fi
- 
--					if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | egrep '5|(^..\?)'`" ]; then
-+					if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep '5|(^..\?)'`" ]; then
- 						HASH_TEST_PASSED=1
- 					else
- 						TEST_RESULT="${TEST_RESULT} verify:hashchanged"
-@@ -11342,7 +11342,7 @@
- 							SYSHASH=`${HASH_CMD} "${FNAME}" 2>/dev/null | cut -d' ' -f $HASH_FLD_IDX`
- 
- 							if [ -z "${SYSHASH}" ]; then
--								if [ -n "`${HASH_CMD} "${FNAME}" 2>&1 | egrep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
-+								if [ -n "`${HASH_CMD} "${FNAME}" 2>&1 | grep 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
- 									if [ "${RKHHASH}" = "ignore-prelink-dep-err" ]; then
- 										SYSHASH="${RKHHASH}"
- 										display --to LOG --type INFO FILE_PROP_IGNORE_PRELINK_DEP_ERR "`name2text \"${FNAME}\"`"
-@@ -11438,7 +11438,7 @@
- 					#
- 
- 					if [ $FILE_IS_PKGD -eq 1 ]; then
--						echo "${PKGMGR_VERIFY_RESULT}" | egrep 'M|(^.\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:permchanged"
-+						echo "${PKGMGR_VERIFY_RESULT}" | grep 'M|(^.\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:permchanged"
- 					else
- 						RKH_CC2=`expr $RKH_CC + 2`
- 
-@@ -11458,7 +11458,7 @@
- 					#
- 
- 					if [ $FILE_IS_PKGD -eq 1 ]; then
--						echo "${PKGMGR_VERIFY_RESULT}" | egrep 'U|(^.....\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:uidchanged"
-+						echo "${PKGMGR_VERIFY_RESULT}" | grep 'U|(^.....\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:uidchanged"
- 					else
- 						RKH_CC2=`expr $RKH_CC + 3`
- 
-@@ -11478,7 +11478,7 @@
- 					#
- 
- 					if [ $FILE_IS_PKGD -eq 1 ]; then
--						echo "${PKGMGR_VERIFY_RESULT}" | egrep 'G|(^......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:gidchanged"
-+						echo "${PKGMGR_VERIFY_RESULT}" | grep 'G|(^......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:gidchanged"
- 					else
- 						RKH_CC2=`expr $RKH_CC + 4`
- 
-@@ -11518,7 +11518,7 @@
- 					#
- 
- 					if [ $FILE_IS_PKGD -eq 1 ]; then
--						if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | egrep 'S|(^\?)'`" ]; then
-+						if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep 'S|(^\?)'`" ]; then
- 							SIZE_TEST_PASSED=1
- 						else
- 							TEST_RESULT="${TEST_RESULT} verify:sizechanged"
-@@ -11546,7 +11546,7 @@
- 					#
- 
- 					if [ $FILE_IS_PKGD -eq 1 ]; then
--						echo "${PKGMGR_VERIFY_RESULT}" | egrep 'T|(^.......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:dtmchanged"
-+						echo "${PKGMGR_VERIFY_RESULT}" | grep 'T|(^.......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:dtmchanged"
- 					elif [ $PRELINKED -eq 0 -o $FILE_IS_PKGD -eq 0 ]; then
- 						RKH_CC2=`expr $RKH_CC + 6`
- 
-@@ -11567,7 +11567,7 @@
- 
- 					if [ -h "${FNAME}" ]; then
- 						if [ $FILE_IS_PKGD -eq 1 ]; then
--							if [ -n "`echo \"${PKGMGR_VERIFY_RESULT}\" | egrep 'L|(^....\?)'`" ]; then
-+							if [ -n "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep 'L|(^....\?)'`" ]; then
- 								if [ $HAVE_READLINK -eq 1 ]; then
- 									# Check the link target to see if it is whitelisted.
- 
-@@ -11713,7 +11713,7 @@
- 						RKHTMPVAR=`${LSATTR_CMD} "${FNAME}" 2>&1 | cut -d' ' -f1 | grep 'i'`
- 					fi
- 				else
--					RKHTMPVAR=`ls -lno "${FNAME}" 2>&1 | ${AWK_CMD} '{ print $5 }' | egrep 'uchg|schg|sappnd|uappnd|sunlnk|sunlink|schange|simmutable|sappend|uappend|uchange|uimmutable'`
-+					RKHTMPVAR=`ls -lno "${FNAME}" 2>&1 | ${AWK_CMD} '{ print $5 }' | grep 'uchg|schg|sappnd|uappnd|sunlnk|sunlink|schange|simmutable|sappend|uappend|uchange|uimmutable'`
- 				fi
- 
- 				#
-@@ -11761,9 +11761,9 @@
- 					test -n "${BASENAME_CMD}" && RKHTMPVAR=`${BASENAME_CMD} "${FNAME}"` || RKHTMPVAR=`echo "${FNAME}" | sed -e 's:^.*/::'`
- 
- 					if [ "${RKHTMPVAR}" = "rkhunter" ]; then
--						SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | egrep -i -v '(shell|/bin/sh) script( |,|$)'`
-+						SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | grep -i -v '(shell|/bin/sh) script( |,|$)'`
- 					else
--						SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | egrep -i ' script( |,|$)'`
-+						SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | grep -i ' script( |,|$)'`
- 					fi
- 
- 					test -n "${SYSSCRIPT}" && TEST_RESULT="${TEST_RESULT} script"
-@@ -12246,10 +12246,10 @@
- 				test ! -e "${SUSPSCAN_ITEM}" && continue
- 
- 				#
--				# Adding "text" to the egrep below widens scope at the expense of more false-positives and extending running time.
-+				# Adding "text" to the grep below widens scope at the expense of more false-positives and extending running time.
- 				#
- 
--				if [ -n "`echo \"${FTYPE}\" | grep -v -i 'compres' | egrep -i 'execu|reloc|shell|libr|data|obj|text'`" ]; then
-+				if [ -n "`echo \"${FTYPE}\" | grep -v -i 'compres' | grep -i 'execu|reloc|shell|libr|data|obj|text'`" ]; then
- 					FOUND=1
- 					SUSPSCAN_NUM=1; SUSPSCAN_SCORE=0; SUSPSCAN_HITCOUNT=0
- 					SUSPSCAN_STRINGS=""
-@@ -13144,7 +13144,7 @@
- 	FOUND=0
- 
- 	if [ -n "${KSYMS_FILE}" ]; then
--		egrep -i 'adore|sebek' "${KSYMS_FILE}" >/dev/null 2>&1 && FOUND=1
-+		grep -i 'adore|sebek' "${KSYMS_FILE}" >/dev/null 2>&1 && FOUND=1
- 	fi
- 
- 	if [ $FOUND -eq 0 ]; then
-@@ -14054,7 +14054,7 @@
- 
- 								FNAMEGREP=`echo "${FNAMEGREP}" | sed -e 's/^|//;'`
- 
--								if [ -n "`echo \"${FNAME}\" | egrep \"^(${FNAMEGREP})$\"`" ]; then
-+								if [ -n "`echo \"${FNAME}\" | grep \"^(${FNAMEGREP})$\"`" ]; then
- 									PROCWHITELISTED=1
- 								fi
- 							else
-@@ -14167,7 +14167,7 @@
- 			RKHLSOF_FILE="${TEMPFILE}"
- 			touch "${RKHLSOF_FILE}"
- 
--			${LSOF_CMD} -wnlP +c 0 2>&1 | egrep -v ' (FIFO|V?DIR|IPv[46]) ' | sort | uniq >"${RKHLSOF_FILE}"
-+			${LSOF_CMD} -wnlP +c 0 2>&1 | grep -v ' (FIFO|V?DIR|IPv[46]) ' | sort | uniq >"${RKHLSOF_FILE}"
- 
- 			#
- 			# Now loop through the known suspicious filenames,
-@@ -14369,7 +14369,7 @@
- 				ROOTKIT_COUNT=`expr $ROOTKIT_COUNT + 1`
- 
- 				SEEN=1
--				FOUND_PROCS=`${UNHIDE_CMD} ${UNHIDE_OPTS} ${RKHTMPVAR} 2>&1 | egrep -v '^(Unhide |yjesus@|http:|Copyright |License |NOTE :|Used options:|\[\*\]|$)'`
-+				FOUND_PROCS=`${UNHIDE_CMD} ${UNHIDE_OPTS} ${RKHTMPVAR} 2>&1 | grep -v '^(Unhide |yjesus@|http:|Copyright |License |NOTE :|Used options:|\[\*\]|$)'`
- 
- 				if [ -z "${FOUND_PROCS}" ]; then
- 					# Nothing found.
-@@ -14950,7 +14950,7 @@
- 			IFS=$IFSNL
- 
- 			# Get the default enabled services.
--			for LINE in `egrep '^[ 	]*enabled[ 	]*\+?=' "${FILENAME}"`; do
-+			for LINE in `grep '^[ 	]*enabled[ 	]*\+?=' "${FILENAME}"`; do
- 				SEEN=1
- 
- 				RKHTMPVAR=`echo "${LINE}" | sed -e 's/^.*=//' | tr -s '	' ' '`
-@@ -14968,7 +14968,7 @@
- 
- 
- 			# Get the default disabled services.
--			for LINE in `egrep '^[ 	]*disabled[ 	]*\+?=' "${FILENAME}"`; do
-+			for LINE in `grep '^[ 	]*disabled[ 	]*\+?=' "${FILENAME}"`; do
- 				RKHTMPVAR=`echo "${LINE}" | sed -e 's/^.*=//' | tr -s '	' ' '`
- 
- 				XINETD_DFLTS_DISABLED="${XINETD_DFLTS_DISABLED} ${RKHTMPVAR}"
-@@ -15017,14 +15017,14 @@
- 			#
- 
- 			if [ -n "${XINETD_DFLTS_ENABLED}" ]; then
--				if [ -n "`echo \"${XINETD_DFLTS_ENABLED}\" | egrep \"${SVCID}\"`" ]; then
--					if [ -z "`echo \"${XINETD_DFLTS_DISABLED}\" | egrep \"${SVCID}\"`" ]; then
-+				if [ -n "`echo \"${XINETD_DFLTS_ENABLED}\" | grep \"${SVCID}\"`" ]; then
-+					if [ -z "`echo \"${XINETD_DFLTS_DISABLED}\" | grep \"${SVCID}\"`" ]; then
- 						SEEN=1
- 						IFS=$IFSNL
- 						break
- 					fi
- 				fi
--			elif [ -n "`echo \"${XINETD_DFLTS_DISABLED}\" | egrep \"${SVCID}\"`" ]; then
-+			elif [ -n "`echo \"${XINETD_DFLTS_DISABLED}\" | grep \"${SVCID}\"`" ]; then
- 				:
- 			elif [ -z "`echo $DATA | grep 'disable = yes'`" ]; then
- 				SEEN=1
-@@ -15361,7 +15361,7 @@
- 			test -f "${DIR}/mod_rootme2.so" && FOUNDFILES="${FOUNDFILES} ${DIR}/mod_rootme2.so"
- 
- 			if [ -f "${DIR}/httpd.conf" ]; then
--				if [ -n "`egrep 'mod_rootme2?\.so' \"${DIR}/httpd.conf\"`" ]; then
-+				if [ -n "`grep 'mod_rootme2?\.so' \"${DIR}/httpd.conf\"`" ]; then
- 					FOUNDFILES="${FOUNDFILES} ${DIR}/httpd.conf"
- 				fi
- 			fi
-@@ -15664,7 +15664,7 @@
- 		${FIND_CMD} "${LKM_PATH}" -type f -a \( -name "*.o" -o -name "*.ko" -o -name "*.ko.xz" \) >"${TEMPFILE}" 2>/dev/null
- 
- 		for RKHTMPVAR in ${LKM_NAMES}; do
--			if [ -n "`egrep \"/${RKHTMPVAR}(\.xz)?$\" "${TEMPFILE}"`" ]; then
-+			if [ -n "`grep \"/${RKHTMPVAR}(\.xz)?$\" "${TEMPFILE}"`" ]; then
- 				FOUND=1
- 				FOUNDFILES="${FOUNDFILES} ${RKHTMPVAR}"
- 			fi
-@@ -15814,10 +15814,10 @@
- 			if [ -n "`echo \"${LSOFLINE}\" | grep \" ${PROTO} \*:${PORT} \"`" ]; then
- 				# Process listening for connections from anywhere.
- 				PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'`
--			elif [ -n "`echo \"${LSOFLINE}\" | egrep \" ${PROTO} [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:${PORT}[ -]\"`" ]; then
-+			elif [ -n "`echo \"${LSOFLINE}\" | grep \" ${PROTO} [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:${PORT}[ -]\"`" ]; then
- 				# Established or listening process using IPv4 address.
- 				PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'`
--			elif [ -n "`echo \"${LSOFLINE}\" | egrep \" ${PROTO} \[[:0-9a-fA-F]+\]:${PORT}[ -]\"`" ]; then
-+			elif [ -n "`echo \"${LSOFLINE}\" | grep \" ${PROTO} \[[:0-9a-fA-F]+\]:${PORT}[ -]\"`" ]; then
- 				# Established or listening process using IPv6 address.
- 				PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'`
- 			else
-@@ -15879,7 +15879,7 @@
- 			if [ "${PROTO}" = "UDP" ]; then
- 				FOUND=`${NETSTAT_CMD} -an | grep -i "^udp.*\.${PORT} " | ${AWK_CMD} '{ print $4 }' | grep "\.${PORT}$"`
- 			elif [ "${PROTO}" = "TCP" ]; then
--				FOUND=`${NETSTAT_CMD} -an | egrep -i "^tcp.*\.${PORT} .*(BOUND|ESTABLISH|LISTEN)" | ${AWK_CMD} '{ print $4 }' | grep "\.${PORT}$"`
-+				FOUND=`${NETSTAT_CMD} -an | grep -i "^tcp.*\.${PORT} .*(BOUND|ESTABLISH|LISTEN)" | ${AWK_CMD} '{ print $4 }' | grep "\.${PORT}$"`
- 			fi
- 			;;
- 		SunOS)
-@@ -15890,10 +15890,10 @@
- 					FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^UDP: IPv6/, /^$/ { print $1 }' | grep "\.${PORT}$"`
- 				fi
- 			elif [ "${PROTO}" = "TCP" ]; then
--				FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv4/, /^$/ { print $0 }' | egrep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"`
-+				FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv4/, /^$/ { print $0 }' | grep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"`
- 
- 				if [ -z "${FOUND}" ]; then
--					FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv6/, /^$/ { print $0 }' | egrep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"`
-+					FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv6/, /^$/ { print $0 }' | grep 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"`
- 				fi
- 			fi
- 			;;
-@@ -16428,7 +16428,7 @@
- 	WHITEPROC=""
- 	BLACKPROC=""
- 
--	LIBPCAPRES=`egrep -v '(^sk | 888e )' /proc/net/packet 2>/dev/null | head ${HEAD_OPT}1`
-+	LIBPCAPRES=`grep -v '(^sk | 888e )' /proc/net/packet 2>/dev/null | head ${HEAD_OPT}1`
- 
- 	if [ -n "${LIBPCAPRES}" ]; then
- 		ALLOWPROCLISTENERS=""
-@@ -16444,7 +16444,7 @@
- 
- 		INODE_LIST=""
- 
--		for INODE in `egrep -v '(^sk | 888e )' /proc/net/packet | ${AWK_CMD} '{ print $9 }'`; do
-+		for INODE in `grep -v '(^sk | 888e )' /proc/net/packet | ${AWK_CMD} '{ print $9 }'`; do
- 			INODE_LIST="${INODE_LIST}|$INODE"
- 		done
- 
-@@ -16452,7 +16452,7 @@
- 		test -z "${INODE_LIST}" && INODE_LIST="RKHunterPktCapture"
- 
- 
--		for PID in `${LSOF_CMD} -lMnPw -d 1-20 2>/dev/null | egrep "[ 	](pack[ 	]+(${INODE_LIST})|sock[ 	]+[^ 	]+[ 	]+[^ 	]+[ 	]+(${INODE_LIST}))[ 	]" | ${AWK_CMD} '{ print $2 }'`; do
-+		for PID in `${LSOF_CMD} -lMnPw -d 1-20 2>/dev/null | grep "[ 	](pack[ 	]+(${INODE_LIST})|sock[ 	]+[^ 	]+[ 	]+[^ 	]+[ 	]+(${INODE_LIST}))[ 	]" | ${AWK_CMD} '{ print $2 }'`; do
- 			NAME=""
- 
- 			if [ -h "/proc/$PID/exe" -a $HAVE_READLINK -eq 1 ]; then
-@@ -16670,7 +16670,7 @@
- 			RKHTMPVAR=`grep "${STRING}" "${FNAME}"`
- 
- 			if [ -n "${RKHTMPVAR}" ]; then
--				test -z "`echo \"${RKHTMPVAR}\" | egrep -v '^[ 	]*#'`" && continue
-+				test -z "`echo \"${RKHTMPVAR}\" | grep -v '^[ 	]*#'`" && continue
- 
- 				if [ -n "`echo \"${RTKT_FILE_WHITELIST}\" | grep \"^${FNAMEGREP}:${STRING}$\"`" ]; then
- 					if [ $VERBOSE_LOGGING -eq 1 ]; then
-@@ -16944,7 +16944,7 @@
- 			if [ -n "${DSCL_CMD}" ]; then
- 				display --to LOG --type INFO FOUND_CMD 'dscl' "${DSCL_CMD}"
- 
--				RKHTMPVAR2=`${DSCL_CMD} . search /Users uid 0 | egrep '^[^ 	)]' | cut -d'	' -f1`
-+				RKHTMPVAR2=`${DSCL_CMD} . search /Users uid 0 | grep '^[^ 	)]' | cut -d'	' -f1`
- 			else
- 				display --to LOG --type INFO NOT_FOUND_CMD 'dscl'
- 			fi
-@@ -17525,7 +17525,7 @@
- 
- 			test $SUNOS -eq 1 -o $IRIXOS -eq 1 && PS_ARGS="-ef"
- 
--			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep '(syslogd|syslog-ng)( |$)' | grep -v 'egrep'`
-+			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep '(syslogd|syslog-ng)( |$)' | grep -v 'grep'`
- 
- 			if [ -n "${RKHTMPVAR}" ]; then
- 				SYSLOG_SEEN=1
-@@ -17545,7 +17545,7 @@
- 				TITLE_SHOWN=1
- 			fi
- 
--			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep 'systemd-journald( |$)' | grep -v 'egrep'`
-+			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep 'systemd-journald( |$)' | grep -v 'grep'`
- 
- 			if [ -n "${RKHTMPVAR}" ]; then
- 				SYSTEMD_SEEN=1
-@@ -17561,7 +17561,7 @@
- 				TITLE_SHOWN=1
- 			fi
- 
--			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep 'metalog( |$)' | grep -v 'egrep'`
-+			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep 'metalog( |$)' | grep -v 'grep'`
- 
- 			if [ -n "${RKHTMPVAR}" ]; then
- 				METALOG_SEEN=1
-@@ -17577,7 +17577,7 @@
- 				TITLE_SHOWN=1
- 			fi
- 
--			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | egrep 'socklog( |$)' | grep -v 'egrep'`
-+			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep 'socklog( |$)' | grep -v 'grep'`
- 
- 			if [ -n "${RKHTMPVAR}" ]; then
- 				SOCKLOG_SEEN=1
-@@ -17638,7 +17638,7 @@
- 					RKHTMPVAR="an"
- 				elif [ -n "`echo \"${FNAME}\" | grep '/syslog-ng\.conf$'`" ]; then
- 					FTYPE="syslog-ng"
--				elif [ -n "`echo \"${FNAME}\" | egrep '/(systemd-)?journald\.conf$'`" ]; then
-+				elif [ -n "`echo \"${FNAME}\" | grep '/(systemd-)?journald\.conf$'`" ]; then
- 					FTYPE="systemd"
- 				else
- 					FTYPE="syslog"
-@@ -17656,15 +17656,15 @@
- 				if [ "${FTYPE}" != "systemd" ]; then
- 					RKHTMPVAR=""
- 
--					if [ -n "`echo \"${FNAME}\" | egrep '/r?syslog\.conf$'`" ]; then
--						RKHTMPVAR=`egrep -i '^[^#].*[ 	](@|:omrelp:).' "${FNAME}" | egrep -i -v '(@|:omrelp:)127\.'`
-+					if [ -n "`echo \"${FNAME}\" | grep '/r?syslog\.conf$'`" ]; then
-+						RKHTMPVAR=`grep -i '^[^#].*[ 	](@|:omrelp:).' "${FNAME}" | grep -i -v '(@|:omrelp:)127\.'`
- 					else
- 						#
- 						# For syslog-ng we must look for a destination
- 						# block which uses TCP or UDP.
- 						#
- 
--						RKHTMPVAR=`${AWK_CMD} '/^[ 	]*destination( |	|$)/, /}/ { print $0 }' "${FNAME}" | egrep -i '( |	|\{|^)(tcp|udp)6?( |	|\(|$)' | egrep -v -i '(tcp|udp)6?[ 	]*\([ 	]*("[ 	]*)?127\.'`
-+						RKHTMPVAR=`${AWK_CMD} '/^[ 	]*destination( |	|$)/, /}/ { print $0 }' "${FNAME}" | grep -i '( |	|\{|^)(tcp|udp)6?( |	|\(|$)' | grep -v -i '(tcp|udp)6?[ 	]*\([ 	]*("[ 	]*)?127\.'`
- 					fi
- 
- 					if [ -n "${RKHTMPVAR}" ]; then
-@@ -17680,7 +17680,7 @@
- 			# that the warnings are shown before anything else.
- 			#
- 
--			if [ $SYSLOG_SEEN -eq 1 -a -z "`echo \"${FILEFOUND}\" | egrep ' (syslog|rsyslog|syslog-ng) '`" ]; then
-+			if [ $SYSLOG_SEEN -eq 1 -a -z "`echo \"${FILEFOUND}\" | grep ' (syslog|rsyslog|syslog-ng) '`" ]; then
- 				display --to SCREEN+LOG --type PLAIN --result WARNING --color RED --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_FILE
- 				display --to LOG --type WARNING SYSTEM_CONFIGS_SYSLOG_NO_FILE 'syslog'
- 			elif [ $SYSTEMD_SEEN -eq 1 -a -z "`echo \"${FILEFOUND}\" | grep ' systemd '`" ]; then
-@@ -17696,7 +17696,7 @@
- 			# We only display the remote logging result if a configuration file was found.
- 			#
- 
--			if [ -n "`echo \"${FILEFOUND}\" | egrep ' (syslog|rsyslog|syslog-ng) '`" ]; then
-+			if [ -n "`echo \"${FILEFOUND}\" | grep ' (syslog|rsyslog|syslog-ng) '`" ]; then
- 				if [ $ALLOW_SYSLOG_REMOTE_LOGGING -eq 1 ]; then
- 					display --to SCREEN+LOG --type PLAIN --result ALLOWED --color GREEN --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_SYSLOG_REMOTE
- 				elif [ $REM_LOGGING_FOUND -eq 0 ]; then
-@@ -17733,7 +17733,7 @@
- 		FTYPE=`echo "${FTYPE}" | tail ${TAIL_OPT}1`
- 	fi
- 
--	if [ -z "`echo \"${FTYPE}\" | egrep -v '(character special|block special|socket|fifo \(named pipe\)|symbolic link to|empty|directory|/MAKEDEV:)'`" ]; then
-+	if [ -z "`echo \"${FTYPE}\" | grep -v '(character special|block special|socket|fifo \(named pipe\)|symbolic link to|empty|directory|/MAKEDEV:)'`" ]; then
- 		return
- 	fi
- 
-@@ -17831,7 +17831,7 @@
- 			RKHTMPVAR=`find_cmd mount`
- 
- 			if [ -n "${RKHTMPVAR}" ]; then
--				test -n "`${RKHTMPVAR} 2>/dev/null | egrep '^fdesc(fs)? .*(type fdesc|\(fdescfs\))'`" && FDESCFS=1
-+				test -n "`${RKHTMPVAR} 2>/dev/null | grep '^fdesc(fs)? .*(type fdesc|\(fdescfs\))'`" && FDESCFS=1
- 			else
- 				display --to LOG --type INFO NOT_FOUND_CMD 'mount'
- 			fi
-@@ -17929,7 +17929,7 @@
- 
- 	for DIR in ${SHORTSEARCHDIRS}; do
- 		if [ -d "${DIR}" ]; then
--			RKHTMPVAR=`ls -1d ${DIR}/.* 2>/dev/null | egrep -v '/\.\.?$'`
-+			RKHTMPVAR=`ls -1d ${DIR}/.* 2>/dev/null | grep -v '/\.\.?$'`
- 			test -n "${RKHTMPVAR}" && LOOKINDIRS="${LOOKINDIRS}
- ${RKHTMPVAR}"
- 		fi
-@@ -17971,7 +17971,7 @@
- 
- 		FTYPE=`${FILE_CMD} "${FNAME}" 2>&1 | ${AWK_CMD} -F':' '{ print $NF }' | cut -c2-`
- 
--		test -n "`echo \"${FTYPE}\" | egrep 'character special|block special|empty'`" && continue
-+		test -n "`echo \"${FTYPE}\" | grep 'character special|block special|empty'`" && continue
- 
- 		FNAMEGREP=`echo "${FNAME}" | sed -e 's/\([.$*?\\]\)/\\\\\1/g; s/\[/\\\\[/g; s/\]/\\\\]/g'`
- 
-@@ -18312,7 +18312,7 @@
- 				;;
- 			named)
- 				WHOLE_VERSION=`${APP_CMD_FOUND} -v 2>/dev/null`
--				VERSION=`echo "${WHOLE_VERSION}" | egrep '^(named|BIND)[ 	][ 	]*[0-9]' | grep -v '/' | ${AWK_CMD} '{ print $2 }'`
-+				VERSION=`echo "${WHOLE_VERSION}" | grep '^(named|BIND)[ 	][ 	]*[0-9]' | grep -v '/' | ${AWK_CMD} '{ print $2 }'`
- 
- 				if [ -n "`echo \"${VERSION}\" | grep '^[^-]*\.[0-9][0-9]*-P[^-]*-'`" ]; then
- 					VERSION=`echo "${VERSION}" | cut -d'-' -f1-2`
-@@ -18376,7 +18376,7 @@
- 			if [ -n "`echo \"${APP_WHITELIST}\" | grep -i \" ${APPLICATION}:${RKHTMPVAR} \"`" ]; then
- 				APP_RESULTS="${APP_RESULTS}
- ${APPLICATION}%${APPLICATION_DESC}%${VERSION}%-1"
--			elif [ -n "`egrep -i \"^${APPLICATION}:.* ${RKHTMPVAR}( |$)\" \"${DB_PATH}/programs_bad.dat\" 2>&1`" ]; then
-+			elif [ -n "`grep -i \"^${APPLICATION}:.* ${RKHTMPVAR}( |$)\" \"${DB_PATH}/programs_bad.dat\" 2>&1`" ]; then
- 				APPS_FAILED_COUNT=`expr ${APPS_FAILED_COUNT} + 1`
- 
- 				APP_RESULTS="${APP_RESULTS}
-@@ -19009,7 +19009,7 @@
- 
- 	PROP_FILE_LIST="adduser amd awk basename bash bget cat chattr checkproc
- 	    chkconfig chmod chown chroot cp cron csh curl cut date depmod df
--	    diff dirname dmesg dpkg dpkg-query du echo ed egrep elinks env fgrep
-+	    diff dirname dmesg dpkg dpkg-query du echo ed grep elinks env fgrep
- 	    file find fsck fuser GET grep groupadd groupdel groupmod groups grpck head id
- 	    ifconfig ifdown ifstatus ifup inetd init insmod ip ipcs kallsyms kill
- 	    killall ksyms kudzu last lastlog ldd less links locate logger login
-@@ -19031,7 +19031,7 @@
- 	SunOS)
- 		PROP_FILE_LIST="${PROP_FILE_LIST} gawk gbasename gcat gchmod gchown
- 				gcksum gcp gcut gdate gdiff gdiff3 gdirname gdu gecho
--				gegrep genv gfile gfind ggrep ggroups ghead gid glocate
-+				ggrep genv gfile gfind ggrep ggroups ghead gid glocate
- 				gls gmd5sum gmv gpwd gsed gsize gsort gstrings gsum
- 				gtail gtest gtouch guname guniq gusers gwc gwho gwhoami
- 				inetadm nawk truss unhide unhide-posix unhide-tcp"
-@@ -19792,8 +19792,8 @@
- # required commands are tested early on using just the root PATH. Then
- # BINDIR is checked, and finally the rest of the commands are then
- # checked using the new PATH from BINDIR.
--ABSOLUTELY_REQUIRED_CMDS="cut egrep grep sed tail tr"
--REQCMDS="awk cat chmod chown cp cut date egrep grep head ls mv sed sort tail touch tr uname uniq wc"
-+ABSOLUTELY_REQUIRED_CMDS="cut grep grep sed tail tr"
-+REQCMDS="awk cat chmod chown cp cut date grep grep head ls mv sed sort tail touch tr uname uniq wc"
- 
- # This will be set to a list of commands that have been disabled.
- DISABLED_CMDS=""
-@@ -20903,10 +20903,10 @@
- 	#
- 
- 	if [ -z "${PRELINK_HASH}" ]; then
--		if [ -z "`echo \"${HASH_FUNC}\" | egrep '(/filehashsha\.pl Digest::MD5|/filehashsha\.pl .* 1$|shasum -a 1$)'`" ]; then
-+		if [ -z "`echo \"${HASH_FUNC}\" | grep '(/filehashsha\.pl Digest::MD5|/filehashsha\.pl .* 1$|shasum -a 1$)'`" ]; then
- 			RKHTMPVAR=`echo "${HASH_FUNC}" | cut -d' ' -f1`
- 
--			if [ -z "`echo ${RKHTMPVAR} | egrep -i 'sha1|md5'`" ]; then
-+			if [ -z "`echo ${RKHTMPVAR} | grep -i 'sha1|md5'`" ]; then
- 				if [ $HASH_OPT -eq 1 ]; then
- 					echo "This system uses prelinking, but the '--hash' option (${HASH_FUNC}) does not look like SHA1 or MD5."
- 				else
-@@ -21014,7 +21014,7 @@
- #
- IFS=$IFSNL
- 
--for LINE in `egrep '^MSG_(TYPE|RESULT)_' "${DB_PATH}/i18n/en" 2>/dev/null`; do
-+for LINE in `grep '^MSG_(TYPE|RESULT)_' "${DB_PATH}/i18n/en" 2>/dev/null`; do
- 	TYPE=`echo "${LINE}" | cut -d: -f1`
- 
- 	if [ "${LANGUAGE}" != "en" ]; then
-@@ -21219,7 +21219,7 @@
- 			fi
- 		elif [ -n "${PRELINK_HASH}" ]; then
- 			display --to LOG --type INFO HASH_FUNC_PRELINK "${PRELINK_HASH}"
--		elif [ -z "`echo \"${HASH_FUNC}\" | egrep -i 'sha1|md5'`" ]; then
-+		elif [ -z "`echo \"${HASH_FUNC}\" | grep -i 'sha1|md5'`" ]; then
- 			SKIP_HASH_MSG=1
- 		else
- 			display --to LOG --type INFO HASH_FUNC "${HASH_FUNC}"
+@@ -9585,7 +9587,7 @@
+ 		    rpc.nfsd:tcp.log:Sniffer installed
+ 		    sshd:/dev/ptyxx:OpenBSD Rootkit
+ 		    sshd:/.config:SHV4 Rootkit
+-		    sshd:+\\$.*\\$\!.*\!\!\\$:Backdoored SSH daemon installed
++		    sshd:+\\$.*\\$!.*!!\\$:Backdoored SSH daemon installed
+ 		    sshd:backdoor.h:Trojaned SSH daemon
+ 		    sshd:backdoor_active:Trojaned SSH daemon
+ 		    sshd:magic_pass_active:Trojaned SSH daemon
diff --git a/rkhunter.spec b/rkhunter.spec
index be0b81e..67513c5 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        20%{?dist}
+Release:        21%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -100,6 +100,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Apr 29 2023 Kevin Fenzi <kevin@scrye.com> - 1.4.6-21
+- More complete fix for egrep changes.
+
 * Mon Apr 10 2023 Kevin Fenzi <kevin@scrye.com> - 1.4.6-20
 - Patch grep/egrep changes to avoid warnings in F38+
 

From b5d434e5901722242bde62d040bed50d6bea8fbc Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 21 Jul 2023 16:55:08 +0000
Subject: [PATCH 113/122] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild

Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 67513c5..100feaf 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        21%{?dist}
+Release:        22%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -100,6 +100,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-22
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
 * Sat Apr 29 2023 Kevin Fenzi <kevin@scrye.com> - 1.4.6-21
 - More complete fix for egrep changes.
 

From 120f482d927547959528d9302c75b3065d7064c1 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Mon, 22 Jan 2024 11:39:32 +0000
Subject: [PATCH 114/122] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 100feaf..ecfc607 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        22%{?dist}
+Release:        23%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -100,6 +100,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-23
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
 * Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-22
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
 

From 5cef75540d36e3ffbcee9d26b7f301a1ca6c3c5e Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 26 Jan 2024 15:28:47 +0000
Subject: [PATCH 115/122] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index ecfc607..0537011 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        23%{?dist}
+Release:        24%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -100,6 +100,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-24
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
 * Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-23
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 

From d622b8fee150b895bcdc7eafe613b31dfa85ce4e Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 19 Jul 2024 18:38:04 +0000
Subject: [PATCH 116/122] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 0537011..b5b4bfc 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        24%{?dist}
+Release:        25%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 License:        GPLv2+
@@ -100,6 +100,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-25
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
 * Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-24
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 

From f8eba31470412dc25c9e482c665013be7e703e48 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Miroslav=20Such=C3=BD?= <msuchy@redhat.com>
Date: Fri, 26 Jul 2024 02:39:10 +0200
Subject: [PATCH 117/122] convert GPLv2+ license to SPDX

This is part of https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4
---
 rkhunter.spec | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index b5b4bfc..df83c88 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,10 +3,11 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        25%{?dist}
+Release:        26%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
-License:        GPLv2+
+# Automatically converted from old format: GPLv2+ - review is highly recommended.
+License:        GPL-2.0-or-later
 URL:            http://rkhunter.sourceforge.net/
 Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz
 Source2:        01-rkhunter
@@ -100,6 +101,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jul 26 2024 Miroslav Suchý <msuchy@redhat.com> - 1.4.6-26
+- convert license to SPDX
+
 * Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-25
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
 

From a8142de0d53e149172dd81df50ec81b5346fd528 Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Sat, 18 Jan 2025 22:30:53 +0000
Subject: [PATCH 118/122] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index df83c88..9283a25 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        26%{?dist}
+Release:        27%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 # Automatically converted from old format: GPLv2+ - review is highly recommended.
@@ -101,6 +101,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-27
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
 * Fri Jul 26 2024 Miroslav Suchý <msuchy@redhat.com> - 1.4.6-26
 - convert license to SPDX
 

From 5f79b238c239a8baac3fc696bf8ab341fd1001fd Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 19 Apr 2025 10:20:00 -0700
Subject: [PATCH 119/122] Add a fix to grep warning about escaping /s. Fixes
 rhbz#2360502

---
 rkhunter-1.4.6-grep-fix.patch | 12 ++++++++++++
 rkhunter.spec                 |  7 ++++++-
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 rkhunter-1.4.6-grep-fix.patch

diff --git a/rkhunter-1.4.6-grep-fix.patch b/rkhunter-1.4.6-grep-fix.patch
new file mode 100644
index 0000000..7b265f8
--- /dev/null
+++ b/rkhunter-1.4.6-grep-fix.patch
@@ -0,0 +1,12 @@
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6.orig/files/rkhunter	2025-04-19 10:15:51.885823861 -0700
++++ rkhunter-1.4.6/files/rkhunter	2025-04-19 10:11:38.420433420 -0700
+@@ -6691,7 +6691,7 @@
+ 					#
+ 
+ 					if [ $ERRCODE -eq 1 -a $BINISLINK -eq 1 ]; then
+-						if [ -n "`echo \"$FNAME\" | grep '^\/usr\/'`" ]; then
++						if [ -n "`echo \"$FNAME\" | grep '^/usr/'`" ]; then
+ 							RKHTMPVAR3=`echo "$FNAMEGREP" | sed -e 's:^/usr::'`
+ 						else
+ 							RKHTMPVAR3="/usr${FNAMEGREP}"
diff --git a/rkhunter.spec b/rkhunter.spec
index 9283a25..b59c71c 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        27%{?dist}
+Release:        28%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 # Automatically converted from old format: GPLv2+ - review is highly recommended.
@@ -19,6 +19,8 @@ Patch1:         rkhunter-1.4.6-drop-libkeyutils-check.patch
 Patch2:         rkhunter-1.4.6-ssh.d.patch
 # Fix grep/egrep changes in f38+
 Patch3:         rkhunter-1.4.6-grep.patch
+# Fix grep warning about escaping / in f42+
+Patch4:         rkhunter-1.4.6-grep-fix.patch
 BuildArch:      noarch
 BuildRequires:      perl-generators
 
@@ -101,6 +103,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Apr 19 2025 Kevin Fenzi <kevin@scrye.com> - 1.4.6-28
+- Add a fix to grep warning about escaping /s. Fixes rhbz#2360502
+
 * Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-27
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
 

From 6292e46ab160d0b5733c7c5815b4a17fdc4f3e0f Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sun, 4 May 2025 11:00:42 -0700
Subject: [PATCH 120/122] Add fix for additional case of grep warnings with
 cron.

---
 rkhunter-1.4.6-grep-fix.patch | 13 +++++++++++--
 rkhunter.spec                 |  5 ++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/rkhunter-1.4.6-grep-fix.patch b/rkhunter-1.4.6-grep-fix.patch
index 7b265f8..d9c2f78 100644
--- a/rkhunter-1.4.6-grep-fix.patch
+++ b/rkhunter-1.4.6-grep-fix.patch
@@ -1,6 +1,6 @@
 diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
---- rkhunter-1.4.6.orig/files/rkhunter	2025-04-19 10:15:51.885823861 -0700
-+++ rkhunter-1.4.6/files/rkhunter	2025-04-19 10:11:38.420433420 -0700
+--- rkhunter-1.4.6.orig/files/rkhunter	2025-05-04 10:41:26.009520652 -0700
++++ rkhunter-1.4.6/files/rkhunter	2025-05-04 10:37:49.439199695 -0700
 @@ -6691,7 +6691,7 @@
  					#
  
@@ -10,3 +10,12 @@ diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunt
  							RKHTMPVAR3=`echo "$FNAMEGREP" | sed -e 's:^/usr::'`
  						else
  							RKHTMPVAR3="/usr${FNAMEGREP}"
+@@ -11005,7 +11005,7 @@
+ 						#
+ 
+ 						if [ $ERRCODE -eq 1 -a $BINISLINK -eq 1 ]; then
+-							if [ -n "`echo \"${FNAME}\" | grep '^\/usr\/'`" ]; then
++							if [ -n "`echo \"${FNAME}\" | grep '^/usr/'`" ]; then
+ 								RKHTMPVAR3=`echo "${FNAMEGREP}" | sed -e 's:^/usr::'`
+ 							else
+ 								RKHTMPVAR3="/usr${FNAMEGREP}"
diff --git a/rkhunter.spec b/rkhunter.spec
index b59c71c..9f0310f 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        28%{?dist}
+Release:        29%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 # Automatically converted from old format: GPLv2+ - review is highly recommended.
@@ -103,6 +103,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sun May 04 2025 Kevin Fenzi <kevin@scrye.com> - 1.4.6-29
+- Add fix for additional case of grep warnings with cron.
+
 * Sat Apr 19 2025 Kevin Fenzi <kevin@scrye.com> - 1.4.6-28
 - Add a fix to grep warning about escaping /s. Fixes rhbz#2360502
 

From 31a16ee1fa7cf4dc690dacd9c0e84d2386b6609b Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 25 Jul 2025 11:59:42 +0000
Subject: [PATCH 121/122] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild

---
 rkhunter.spec | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/rkhunter.spec b/rkhunter.spec
index 9f0310f..8ed252d 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        29%{?dist}
+Release:        30%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 # Automatically converted from old format: GPLv2+ - review is highly recommended.
@@ -103,6 +103,9 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-30
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
 * Sun May 04 2025 Kevin Fenzi <kevin@scrye.com> - 1.4.6-29
 - Add fix for additional case of grep warnings with cron.
 

From 3474090453c9d4b6052b1df90d3a9c4bec3f4296 Mon Sep 17 00:00:00 2001
From: Kevin Fenzi <kevin@scrye.com>
Date: Sat, 3 Jan 2026 10:43:13 -0800
Subject: [PATCH 122/122] Add patch to find systemd-journald config and avoid
 warning. Fixes rhbz#2361203

Add patch to fix false positive on Li0n from bin/sbin merge. Fixes rhbz#2382304
---
 rkhunter-1.4.6-Li0n-fix.patch        | 13 +++++++++++++
 rkhunter-1.4.6-journald-config.patch | 12 ++++++++++++
 rkhunter.spec                        | 10 +++++++++-
 3 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 rkhunter-1.4.6-Li0n-fix.patch
 create mode 100644 rkhunter-1.4.6-journald-config.patch

diff --git a/rkhunter-1.4.6-Li0n-fix.patch b/rkhunter-1.4.6-Li0n-fix.patch
new file mode 100644
index 0000000..e484db2
--- /dev/null
+++ b/rkhunter-1.4.6-Li0n-fix.patch
@@ -0,0 +1,13 @@
+diff --color -Nur rkhunter-1.4.6/files/rkhunter rkhunter-1.4.6-build/rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6/files/rkhunter	2026-01-03 10:15:00.159046977 -0800
++++ rkhunter-1.4.6/files/rkhunter	2026-01-03 10:22:54.440297219 -0800
+@@ -8680,8 +8680,7 @@
+ 
+ 
+ 	# Lion Worm
+-	LION_FILES="/bin/in.telnetd
+-		    /bin/mjy
++	LION_FILES="/bin/mjy
+ 		    /usr/man/man1/man1/lib/.lib/mjy
+ 		    /usr/man/man1/man1/lib/.lib/in.telnetd
+ 		    /usr/man/man1/man1/lib/.lib/.x
diff --git a/rkhunter-1.4.6-journald-config.patch b/rkhunter-1.4.6-journald-config.patch
new file mode 100644
index 0000000..f214af7
--- /dev/null
+++ b/rkhunter-1.4.6-journald-config.patch
@@ -0,0 +1,12 @@
+diff --color -Nur rkhunter-1.4.6/files/rkhunter rkhunter-1.4.6-build/rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6/files/rkhunter	2026-01-03 10:15:00.159046977 -0800
++++ rkhunter-1.4.6/files/rkhunter	2026-01-03 10:18:12.190029798 -0800
+@@ -17615,7 +17615,7 @@
+ 		#
+ 
+ 		if [ -z "${SYSLOG_CONFIG_FILE}" ]; then
+-			SYSLOG_CONFIG_FILE="/etc/syslog.conf /etc/rsyslog.conf /etc/syslog-ng/syslog-ng.conf /etc/systemd/journald.conf /etc/systemd/systemd-journald.conf"
++			SYSLOG_CONFIG_FILE="/etc/syslog.conf /etc/rsyslog.conf /etc/syslog-ng/syslog-ng.conf /etc/systemd/journald.conf /etc/systemd/systemd-journald.conf /usr/lib/systemd/journald.conf"
+ 		fi
+ 
+ 		if [ "${SYSLOG_CONFIG_FILE}" = "NONE" ]; then
diff --git a/rkhunter.spec b/rkhunter.spec
index 8ed252d..aa2d9a2 100644
--- a/rkhunter.spec
+++ b/rkhunter.spec
@@ -3,7 +3,7 @@
 
 Name:           rkhunter
 Version:        1.4.6
-Release:        30%{?dist}
+Release:        31%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 # Automatically converted from old format: GPLv2+ - review is highly recommended.
@@ -21,6 +21,10 @@ Patch2:         rkhunter-1.4.6-ssh.d.patch
 Patch3:         rkhunter-1.4.6-grep.patch
 # Fix grep warning about escaping / in f42+
 Patch4:         rkhunter-1.4.6-grep-fix.patch
+# Fix systemd-journald config path
+Patch5:         rkhunter-1.4.6-journald-config.patch
+# Fix false positive Li0n detection due to bin/sbin merge
+Patch6:         rkhunter-1.4.6-Li0n-fix.patch
 BuildArch:      noarch
 BuildRequires:      perl-generators
 
@@ -103,6 +107,10 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Sat Jan 03 2026 Kevin Fenzi <kevin@scrye.com> - 1.4.6-31
+- Add patch to find systemd-journald config and avoid warning. Fixes rhbz#2361203
+- Add patch to fix false positive on Li0n from bin/sbin merge. Fixes rhbz#2382304
+
 * Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-30
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild