From d7c2128ee599ec1a7ae751b228b0274e3300db18 Mon Sep 17 00:00:00 2001 From: Gwyn Ciesla Date: Tue, 3 Sep 2019 09:14:17 -0500 Subject: [PATCH 1/5] "Adding package.cfg file" --- package.cfg | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 package.cfg diff --git a/package.cfg b/package.cfg new file mode 100644 index 0000000..66ea79d --- /dev/null +++ b/package.cfg @@ -0,0 +1,2 @@ +[koji] +targets = epel8 epel8-playground \ No newline at end of file From 6a4209648fff5cee9b7cdebf80dd7badb7cadee6 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sun, 15 Sep 2019 12:07:08 -0700 Subject: [PATCH 2/5] Initial rkhunter for epel8 Signed-off-by: Kevin Fenzi --- .cvsignore | 0 .gitignore | 1 + 01-rkhunter | 57 ++++ Makefile | 21 -- package.cfg | 2 +- rkhunter-1.4.6-fedoraconfig.patch | 214 ++++++++++++++ rkhunter.spec | 467 ++++++++++++++++++++++++++++++ rkhunter.sysconfig | 10 + sources | 1 + 9 files changed, 751 insertions(+), 22 deletions(-) delete mode 100644 .cvsignore create mode 100644 .gitignore create mode 100755 01-rkhunter delete mode 100644 Makefile create mode 100644 rkhunter-1.4.6-fedoraconfig.patch create mode 100644 rkhunter.spec create mode 100644 rkhunter.sysconfig diff --git a/.cvsignore b/.cvsignore deleted file mode 100644 index e69de29..0000000 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..a5cd031 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +/rkhunter-1.4.6.tar.gz diff --git a/01-rkhunter b/01-rkhunter new file mode 100755 index 0000000..1e85c8e --- /dev/null +++ b/01-rkhunter @@ -0,0 +1,57 @@ +#!/bin/sh +# 01-rkhunter A shell script to update and run rkhunter via CRON + +XITVAL=0 + +# Get a secure tempfile +TMPFILE1=`/bin/mktemp -p /var/lib/rkhunter rkhcronlog.XXXXXXXXXX` || exit 1 + +if [ ! -e /var/lock/subsys/rkhunter ]; then + + # Try to keep the SysInit boot scan from colliding with us (highly unlikely) + /bin/touch /var/lock/subsys/rkhunter + + # Source system configuration parameters. + if [ -e /etc/sysconfig/rkhunter ] ; then + . /etc/sysconfig/rkhunter + else + MAILTO=root@localhost + fi + + # If a diagnostic mode scan was requested, setup the parameters + if [ "$DIAG_SCAN" = "yes" ]; then + RKHUNTER_FLAGS="--checkall --skip-keypress --nocolors --quiet --appendlog --display-logfile" + else + RKHUNTER_FLAGS="--cronjob --nocolors --report-warnings-only" + fi + + # Set a few critical parameters + RKHUNTER=/usr/bin/rkhunter + LOGFILE=/var/log/rkhunter/rkhunter.log + + # Run RootKit Hunter if available + if [ -x $RKHUNTER ]; then + /bin/echo -e "\n--------------------- Start Rootkit Hunter Update ---------------------" \ + > $TMPFILE1 + /bin/nice -n 10 $RKHUNTER --update --nocolors 2>&1 >> $TMPFILE1 + /bin/echo -e "\n---------------------- Start Rootkit Hunter Scan ----------------------" \ + >> $TMPFILE1 + /bin/nice -n 10 $RKHUNTER $RKHUNTER_FLAGS 2>&1 >> $TMPFILE1 + XITVAL=$? + /bin/echo -e "\n----------------------- End Rootkit Hunter Scan -----------------------" \ + >> $TMPFILE1 + + if [ $XITVAL != 0 ]; then + /bin/cat $TMPFILE1 | /bin/mail -s "rkhunter Daily Run on $(hostname)" $MAILTO + fi + /bin/cat $TMPFILE1 >> $LOGFILE + fi + + # Delete the gating lockfile + /bin/rm -f /var/lock/subsys/rkhunter +fi + +# Delete the secure tempfile +/bin/rm -f $TMPFILE1 + +exit $XITVAL diff --git a/Makefile b/Makefile deleted file mode 100644 index 0639c2d..0000000 --- a/Makefile +++ /dev/null @@ -1,21 +0,0 @@ -# Makefile for source rpm: rkhunter -# $Id$ -NAME := rkhunter -SPECFILE = $(firstword $(wildcard *.spec)) - -define find-makefile-common -for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done -endef - -MAKEFILE_COMMON := $(shell $(find-makefile-common)) - -ifeq ($(MAKEFILE_COMMON),) -# attept a checkout -define checkout-makefile-common -test -f CVS/Rootx && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2 -endef - -MAKEFILE_COMMON := $(shell $(checkout-makefile-common)) -endif - -include $(MAKEFILE_COMMON) diff --git a/package.cfg b/package.cfg index 66ea79d..7e5a05b 100644 --- a/package.cfg +++ b/package.cfg @@ -1,2 +1,2 @@ [koji] -targets = epel8 epel8-playground \ No newline at end of file +targets = epel8 epel8-playground diff --git a/rkhunter-1.4.6-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch new file mode 100644 index 0000000..4dbc624 --- /dev/null +++ b/rkhunter-1.4.6-fedoraconfig.patch @@ -0,0 +1,214 @@ +diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf +--- rkhunter-1.4.6.orig/files/rkhunter.conf 2018-02-19 15:49:06.000000000 -0800 ++++ rkhunter-1.4.6/files/rkhunter.conf 2019-04-14 16:30:22.914740071 -0700 +@@ -158,6 +158,7 @@ + # default directory beneath the installation directory. + # + #TMPDIR=/var/lib/rkhunter/tmp ++TMPDIR=/var/lib/rkhunter + + # + # This option specifies the database directory to use. +@@ -167,6 +168,7 @@ + # default directory beneath the installation directory. + # + #DBDIR=/var/lib/rkhunter/db ++DBDIR=/var/lib/rkhunter/db + + # + # This option specifies the script directory to use. +@@ -175,6 +177,7 @@ + # subsequently commented out or removed, then the program will not run. + # + #SCRIPTDIR=/usr/local/lib/rkhunter/scripts ++SCRIPTDIR=/usr/share/rkhunter/scripts + + # + # This option can be used to modify the command directory list used by rkhunter +@@ -231,7 +234,7 @@ + # + # The default value is '/var/log/rkhunter.log'. + # +-LOGFILE=/var/log/rkhunter.log ++LOGFILE=/var/log/rkhunter/rkhunter.log + + # + # Set this option to '1' if the log file is to be appended to whenever rkhunter +@@ -241,6 +244,7 @@ + # The default value is '0'. + # + #APPEND_LOG=0 ++APPEND_LOG=1 + + # + # Set the following option to '1' if the log file is to be copied when rkhunter +@@ -307,6 +311,7 @@ + # The default value is 'no'. + # + #ALLOW_SSH_ROOT_USER=no ++ALLOW_SSH_ROOT_USER=yes + + # + # Set this option to '1' to allow the use of the SSH-1 protocol, but note +@@ -321,6 +326,7 @@ + # The default value is '0'. + # + #ALLOW_SSH_PROT_V1=0 ++ALLOW_SSH_PROT_V1=2 + + # + # This setting tells rkhunter the directory containing the SSH configuration +@@ -353,7 +359,8 @@ + # program defaults. + # + ENABLE_TESTS=ALL +-DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps ++#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps ++DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps ipc_shared_mem + + # + # The HASH_CMD option can be used to specify the command to use for the file +@@ -435,6 +442,7 @@ + # Also see the PKGMGR_NO_VRFY and USE_SUNSUM options. + # + #PKGMGR=NONE ++PKGMGR=RPM + + # + # It is possible that a file, which is part of a package, may have been +@@ -558,6 +566,17 @@ + # The default value is the null string. + # + #EXISTWHITELIST="" ++EXISTWHITELIST=/bin/ad ++# FreeIPA Certificate Authority ++EXISTWHITELIST=/var/log/pki-ca/system ++# FreeIPA Certificate Authority ++EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system ++# FreeIPA with KRA (Password Vault) ++EXISTWHITELIST=/var/log/pki/pki-tomcat/kra/system ++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/kra/system ++# Some non default installed files we check ++EXISTWHITELIST=/usr/bin/GET ++EXISTWHITELIST=/usr/bin/whatis + + # + # Whitelist various attributes of the specified file. The attributes are those +@@ -588,6 +607,10 @@ + # The default value is the null string. + # + #SCRIPTWHITELIST=/usr/bin/groups ++SCRIPTWHITELIST=/usr/bin/whatis ++SCRIPTWHITELIST=/usr/bin/ldd ++SCRIPTWHITELIST=/usr/bin/groups ++SCRIPTWHITELIST=/usr/bin/GET + + # + # Allow the specified file to have the immutable attribute set. +@@ -630,6 +653,19 @@ + #ALLOWHIDDENDIR=/dev/.udev + #ALLOWHIDDENDIR=/dev/.udevdb + #ALLOWHIDDENDIR=/dev/.mdadm ++ALLOWHIDDENDIR="/etc/.java" ++ALLOWHIDDENDIR=/dev/.udev ++ALLOWHIDDENDIR=/dev/.udevdb ++ALLOWHIDDENDIR=/dev/.udev.tdb ++ALLOWHIDDENDIR=/dev/.static ++ALLOWHIDDENDIR=/dev/.initramfs ++ALLOWHIDDENDIR=/dev/.SRC-unix ++ALLOWHIDDENDIR=/dev/.mdadm ++ALLOWHIDDENDIR=/dev/.systemd ++ALLOWHIDDENDIR=/dev/.mount ++# for etckeeper ++ALLOWHIDDENDIR=/etc/.git ++ALLOWHIDDENDIR=/etc/.bzr + + # + # Allow the specified hidden file to be whitelisted. +@@ -645,6 +681,32 @@ + #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac + #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac + #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac ++ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz" ++ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac ++ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac ++ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac ++ALLOWHIDDENFILE=/usr/bin/.ssh.hmac ++ALLOWHIDDENFILE=/usr/bin/.ssh-keygen.hmac ++ALLOWHIDDENFILE=/usr/bin/.ssh-keyscan.hmac ++ALLOWHIDDENFILE=/usr/bin/.ssh-add.hmac ++ALLOWHIDDENFILE=/usr/bin/.ssh-agent.hmac ++ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.*.hmac ++ALLOWHIDDENFILE=/usr/lib*/.libgcrypt.so.*.hmac ++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha1hmac.hmac ++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha256hmac.hmac ++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha384hmac.hmac ++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha512hmac.hmac ++ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac ++ALLOWHIDDENFILE=/dev/.mdadm.map ++ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz ++ALLOWHIDDENFILE=/usr/share/man/man5/.k5identity.5.gz ++ALLOWHIDDENFILE=/usr/sbin/.ipsec.hmac ++# etckeeper ++ALLOWHIDDENFILE=/etc/.etckeeper ++ALLOWHIDDENFILE=/etc/.gitignore ++ALLOWHIDDENFILE=/etc/.bzrignore ++# systemd ++ALLOWHIDDENFILE=/etc/.updated + + # + # Allow the specified process to use deleted files. The process name may be +@@ -714,6 +776,35 @@ + # + #ALLOWDEVFILE=/dev/shm/pulse-shm-* + #ALLOWDEVFILE=/dev/shm/sem.ADBE_* ++ALLOWDEVFILE=/dev/shm/pulse-shm-* ++ALLOWDEVFILE=/dev/md/md-device-map ++# tomboy creates this one ++ALLOWDEVFILE="/dev/shm/mono.*" ++# created by libv4l ++ALLOWDEVFILE="/dev/shm/libv4l-*" ++# created by spice video ++ALLOWDEVFILE="/dev/shm/spice.*" ++# created by mdadm ++ALLOWDEVFILE="/dev/md/autorebuild.pid" ++# 389 Directory Server ++ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats ++# squid proxy ++ALLOWDEVFILE=/dev/shm/squid-cf* ++# squid ssl cache ++ALLOWDEVFILE=/dev/shm/squid-ssl_session_cache.shm ++# allow lldpad state file ++ALLOWDEVFILE=/dev/shm/lldpad.state ++# Allow PCS/Pacemaker/Corosync ++ALLOWDEVFILE=/dev/shm/qb-attrd-* ++ALLOWDEVFILE=/dev/shm/qb-cfg-* ++ALLOWDEVFILE=/dev/shm/qb-cib_rw-* ++ALLOWDEVFILE=/dev/shm/qb-cib_shm-* ++ALLOWDEVFILE=/dev/shm/qb-corosync-* ++ALLOWDEVFILE=/dev/shm/qb-cpg-* ++ALLOWDEVFILE=/dev/shm/qb-lrmd-* ++ALLOWDEVFILE=/dev/shm/qb-pengine-* ++ALLOWDEVFILE=/dev/shm/qb-quorum-* ++ALLOWDEVFILE=/dev/shm/qb-stonith-* + + # + # Allow the specified process pathnames to use shared memory segments. +@@ -1090,6 +1181,11 @@ + # + #RTKT_DIR_WHITELIST="" + #RTKT_FILE_WHITELIST="" ++RTKT_FILE_WHITELIST=/bin/ad ++# FreeIPA Certificate Authority ++RTKT_FILE_WHITELIST=/var/log/pki-ca/system ++# FreeIPA Certificate Authority ++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/ca/system + + # + # The following option can be used to whitelist shared library files that would +@@ -1329,3 +1425,5 @@ + # The default value is '0'. + # + #GLOBSTAR=0 ++ ++INSTALLDIR="/usr" diff --git a/rkhunter.spec b/rkhunter.spec new file mode 100644 index 0000000..e627535 --- /dev/null +++ b/rkhunter.spec @@ -0,0 +1,467 @@ +# In f20+ use unversioned docdirs, otherwise the old versioned one +%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}} + +Name: rkhunter +Version: 1.4.6 +Release: 5%{?dist} +Summary: A host-based tool to scan for rootkits, backdoors and local exploits + +License: GPLv2+ +URL: http://rkhunter.sourceforge.net/ +Source0: http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz +Source2: 01-rkhunter +Source3: rkhunter.sysconfig +Patch0: rkhunter-1.4.6-fedoraconfig.patch +BuildArch: noarch +BuildRequires: perl-generators + +Requires: coreutils, binutils, kmod, findutils, grep +Requires: e2fsprogs, procps, lsof, iproute, wget +Requires: perl-interpreter, perl(strict), perl(IO::Socket), mailx, logrotate +Requires: crontabs + +%description +Rootkit Hunter (RKH) is an easy-to-use tool which checks +computers running UNIX (clones) for the presence of rootkits +and other unwanted tools. + +%prep + +%autosetup -p1 + +%{__cat} <<'EOF' >%{name}.logrotate +%{_localstatedir}/log/%{name}/%{name}.log { + weekly + notifempty + create 640 root root +} +EOF + +%build +# Nothing to be built + +%install +%{__rm} -rf $RPM_BUILD_ROOT + +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_bindir} +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_sysconfdir}/{cron.daily,sysconfig,logrotate.d} +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_pkgdocdir} +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8 +%{__mkdir} -m700 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name} +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/log/%{name} +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n + +%{__install} -m755 -p files/%{name} ${RPM_BUILD_ROOT}%{_bindir}/ + +%{__install} -m644 -p files/backdoorports.dat ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/ +%{__install} -m644 -p files/mirrors.dat ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/ +%{__install} -m644 -p files/programs_bad.dat ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/ +%{__install} -m644 -p files/i18n/cn ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n/ +%{__install} -m644 -p files/i18n/en ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n/ + +%{__install} -m644 -p files/CHANGELOG ${RPM_BUILD_ROOT}%{_pkgdocdir} +%{__install} -m644 -p files/LICENSE ${RPM_BUILD_ROOT}%{_pkgdocdir} +%{__install} -m644 -p files/README ${RPM_BUILD_ROOT}%{_pkgdocdir} +%{__install} -m755 -p files/check_modules.pl ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/ +%{__install} -m644 -p files/*.8 ${RPM_BUILD_ROOT}%{_mandir}/man8/ +# Don't ship these unless we want to Require the perl modules +#%{__install} -m750 -p files/filehashmd5.pl ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/ +#%{__install} -m750 -p files/filehashsha1.pl ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/ +%{__install} -m755 -p %{SOURCE2} ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/%{name} +%{__install} -m644 -p %{name}.logrotate ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/%{name} +%{__install} -m640 -p files/%{name}.conf ${RPM_BUILD_ROOT}%{_sysconfdir}/ +%{__install} -m640 -p %{SOURCE3} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name} + +%files +%doc %{_pkgdocdir}/* +%{_bindir}/%{name} +%dir %{_datadir}/%{name} +%{_datadir}/%{name}/scripts +%{_sysconfdir}/cron.daily/%{name} +%config(noreplace) %{_sysconfdir}/logrotate.d/%{name} +%dir %{_var}/lib/%{name} +%{_var}/lib/%{name}/db +%ghost %{_var}/lib/%{name}/db/mirrors.dat +%ghost %{_var}/lib/%{name}/db/programs_bad.dat +%{_var}/lib/%{name}/db/i18n +%dir %{_var}/log/%{name} +%config(noreplace) %{_sysconfdir}/%{name}.conf +%config(noreplace) %{_sysconfdir}/sysconfig/%{name} +%dir %{_pkgdocdir} +%{_mandir}/man8/* + +%changelog +* Fri Jul 26 2019 Fedora Release Engineering - 1.4.6-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Sun Apr 14 2019 Kevin Fenzi - 1.4.6-4 +- Drop ifup/ifdown since network-scripts is now deprecated. Fixes bug #1698920 + +* Sat Feb 02 2019 Fedora Release Engineering - 1.4.6-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Sat Jul 14 2018 Fedora Release Engineering - 1.4.6-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Sun Feb 25 2018 Kevin Fenzi - 1.4.6-1 +- Update to 1.4.6. Fixes bug #1547315 +- Allow KRA vault log files. Fixes bug #1541472 +- ipc_shared_mem warning fixed upstream. Fixes bug #1524456 + +* Fri Feb 09 2018 Igor Gnatenko - 1.4.4-6 +- Escape macros in %%changelog + +* Mon Nov 27 2017 Kevin Fenzi - 1.4.4-5 +- Add fix for new rpm queryformat and ARCH. Fixes bug #1517387 + +* Sat Aug 12 2017 Kevin Fenzi - 1.4.4-4 +- Disable ipc_shared_mem test for now due to false positives. Bug #1472299 + +* Thu Jul 27 2017 Fedora Release Engineering - 1.4.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Thu Jul 13 2017 Petr Pisar - 1.4.4-2 +- perl dependency renamed to perl-interpreter + + +* Thu Jun 29 2017 Kevin Fenzi - 1.4.4-1 +- Update to 1.4.4. Fixes bug #1466318 +- Fix for logger and spaces. Fixes bug #1284403 + +* Sat Feb 11 2017 Fedora Release Engineering - 1.4.2-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Wed Jan 25 2017 Mukundan Ragavan - 1.4.2-12 +- Add /dev/shm/qb* files to whitelist. Fixes bug #1403602 +- Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug #1411130 + +* Wed Apr 20 2016 Kevin Fenzi - 1.4.2-11 +- Add /dev/shm/lldpad files to whitelist. Fixes bug #1293059 + +* Thu Feb 04 2016 Fedora Release Engineering - 1.4.2-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Sun Dec 06 2015 Kevin Fenzi - 1.4.2-9 +- Add /dev/shm/squid files to whitelist. Fixes bug #1279632 + +* Tue Oct 13 2015 Mukundan Ragavan - 1.4.2-8 +- Change config patch to account for change in default SSH config + +* Thu Jun 18 2015 Fedora Release Engineering - 1.4.2-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Sat Dec 20 2014 Kevin Fenzi 1.4.2-6 +- Add /etc/.updated systemd file to whitelist. Fixes bug #1173481 +- Add patch to fix grep -a issue with too many arguments output. + +* Mon Oct 27 2014 Kevin Fenzi 1.4.2-5 +- Set /var/lib/rkhunter to be mode 700. fixes bug #1154428 + +* Fri Sep 26 2014 Kevin Fenzi 1.4.2-4 +- Fix cron script to work with non bash shells. Fixes bug #1146717 + +* Sun Jun 08 2014 Fedora Release Engineering - 1.4.2-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Sun Apr 06 2014 Kevin Fenzi 1.4.2-2 +- Add patch to fix ipcs command in non en locales +- Add config to fix freeipa installs. Fixes bug #994567 + +* Fri Mar 14 2014 Kevin Fenzi 1.4.2-1 +- Update to 1.4.2 + +* Sun Sep 01 2013 Kevin Fenzi 1.4.0-9 +- Add patch for now to help spaces in allowdev file handling. Fixes bug #984180 + +* Sat Aug 03 2013 Petr Pisar - 1.4.0-9 +- Perl 5.18 rebuild + +* Sat Jul 27 2013 Kevin Fenzi 1.4.0-8 +- Fix for unversioned docs +- Requires: crontabs. Fixes bug #989110 + +* Wed Jul 17 2013 Petr Pisar - 1.4.0-7 +- Perl 5.18 rebuild + +* Thu Feb 14 2013 Fedora Release Engineering - 1.4.0-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + +* Sat Oct 06 2012 Kevin Fenzi 1.4.0-5 +- Add /dev/md/autorebuild.pid to whitelist. Fixes bug #857315 + +* Sat Aug 18 2012 Kevin Fenzi 1.4.0-4 +- Add /var/log/pki-ca/system to whitelist for FreeIPA. Fixes bug #849251 + +* Wed Aug 15 2012 Kevin Fenzi 1.4.0-3 +- Fix /bin/ad false positive. Fixes bug #831989 + +* Sat Jul 21 2012 Fedora Release Engineering - 1.4.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Tue May 08 2012 Kevin Fenzi - 1.4.0-1 +- Update to 1.4.0 + +* Sun Apr 15 2012 Kevin Fenzi - 1.3.8-15 +- Add workaround for /lib/java false positive. Fixes bug #806972 + +* Wed Feb 8 2012 Kay Sievers - 1.3.8-14 +- modutils are for Linux 2.4 and no longer provided; depend on kmod + +* Fri Jan 27 2012 Kevin Fenzi 1.3.8-13 +- Drop net-tools, no longer needed. Fixes bug #784803 +- Add /dev/shm/spice.* to whitelist. Fixes bug #784882 + +* Fri Jan 06 2012 Kevin Fenzi 1.3.8-12 +- Add /etc/.java to whitelist. Fixes bug #770972 + +* Fri Nov 25 2011 Kevin Fenzi - 1.3.8-11 +- Add /usr/share/man/man5/.k5identity.5.gz to whitelisted hidden files. + +* Wed Oct 12 2011 Jim Pirzyk - 1.3.8-10 +- Update %%files section so that some .dat files are marked %%ghost + +* Fri Aug 05 2011 Kevin Fenzi - 1.3.8-9 +- Add patch to fix ALLOWPROCDELFILE config option. fixes bug #727524 + +* Fri Jul 08 2011 Kevin Fenzi - 1.3.8-8 +- Fix typo + +* Fri Jul 08 2011 Kevin Fenzi - 1.3.8-7 +- Add patch to fix out of the box warning on rkhunter script. +- Fixes bug #719270 +- Add etckeeper and tomboy files. Fixes bug #719265 and #719259 + +* Tue Jun 21 2011 Kevin Fenzi - 1.3.8-6 +- Change ssh check back to 2 - bug #596775 +- Drop hard Requires on prelink. It will be used if present - bug #714067 + +* Thu Apr 21 2011 Kevin Fenzi - 1.3.8-5 +- Add /dev/.mount to ALLOW_HIDDENDIR - bug #697599 + +* Wed Apr 13 2011 Kevin Fenzi - 1.3.8-4 +- Don't send warning emails anymore. They cause selinux issues and are not very helpful. +- Fixes bug #660544 + +* Wed Feb 09 2011 Fedora Release Engineering - 1.3.8-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Tue Dec 07 2010 Kevin Fenzi - 1.3.8-2 +- Adjust config some - bug #596775 + +* Fri Nov 26 2010 Kevin Fenzi - 1.3.8-1 +- Update to 1.3.8 + +* Wed Nov 24 2010 Kevin Fenzi - 1.3.6-9 +- Drop /var/run as it's not used anymore - bug #656684 + +* Wed Oct 06 2010 Kevin Fenzi - 1.3.6-8 +- Add patch to make rkhunter use unhide if installed - bug #636396 + +* Sat Jun 05 2010 Kevin Fenzi - 1.3.6-7 +- Add ipsec.hmac exclude - bug #560594 + +* Fri May 28 2010 Kevin Fenzi - 1.3.6-6 +- Add exclude for md-device-map - bug #596731 +- Supress ssh version check - bug #596775 + +* Sat Mar 06 2010 Kevin Fenzi - 1.3.6-5 +- Change config to not specify XINETD_PATH - bug #560562 + +* Sat Jan 23 2010 Kevin Fenzi - 1.3.6-4 +- Change email to just root instead of root@localhost - bug #553179 +- Add .k5login.5.gz to files whitelist - bug #553134 + +* Tue Jan 05 2010 Kevin Fenzi - 1.3.6-3 +- Add some more ssh hmac files to whitelist - bug #552621 +- Re-add /dev/.mdadm.map to whitelisted files - bug #539405 + +* Tue Dec 01 2009 Kevin Fenzi - 1.3.6-2 +- Disable apps check by default - bug #543065 + +* Sun Nov 29 2009 Kevin Fenzi - 1.3.6-1 +- Update to 1.3.6 + +* Thu Nov 26 2009 Kevin Fenzi - 1.3.4-9 +- Add exception for /dev/.mdadm file - bug #539405 + +* Sun Jul 26 2009 Fedora Release Engineering - 1.3.4-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Fri Jul 03 2009 Kevin Fenzi - 1.3.4-7 +- Add exception for software raid udev file - bug #509253 + +* Sat Jun 06 2009 Kevin Fenzi - 1.3.4-6 +- Add /usr/bin/.fipscheck.hmac to ok files - bug #494096 + +* Sun Mar 08 2009 Kevin Fenzi - 1.3.4-5 +- Fix typo in patch file + +* Wed Mar 04 2009 Kevin Fenzi - 1.3.4-4 +- Rework spec file +- Add check for the new hmac ssh files + +* Thu Feb 26 2009 Kevin Fenzi - 1.3.4-3 +- Update cron job to include hostname (thanks Manuel Wolfshant) + +* Wed Feb 25 2009 Fedora Release Engineering - 1.3.4-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Fri Jan 02 2009 Kevin Fenzi - 1.3.4-1 +- Update to 1.3.4 +- Use libdir as tmp dir - bug #456340 + +* Sat Dec 13 2008 Kevin Fenzi - 1.3.2-6 +- Fix cron job sending as attachment - bug #472679 +- Fix cron job trying to send with colors - bug #475916 + +* Wed Sep 03 2008 Kevin Fenzi - 1.3.2-5 +- Patch debug tmp file issue - bug #460628 + +* Mon Jun 16 2008 Kevin Fenzi - 1.3.2-4 +- Fix cron script to only mail on warn/error - bug #450703 +- Fix conditional to account for fc10 rsyslog + +* Mon Apr 28 2008 Kevin Fenzi - 1.3.2-3 +- Change cron to run after prelink - bug #438622 + +* Wed Mar 26 2008 Kevin Fenzi - 1.3.2-2 +- Move things to more standard locations for selinux - bug #438184 +- Add exception for pulseaudio file - bug #438622 + +* Thu Feb 28 2008 Kevin Fenzi - 1.3.2-1 +- Update to 1.3.2 +- Fix cron script + +* Thu Feb 28 2008 Kevin Fenzi - 1.3.0-2 +- Use /etc/redhat-release for EPEL and /etc/fedora release for Fedora. +- Add conditionals to support EPEL +- Fix man page warning. + +* Sun Feb 03 2008 Kevin Fenzi - 1.3.0-1 +- Revive package, clean up spec +- Update to 1.3.0 + +* Sat Mar 18 2006 Greg Houlette - 1.2.8-3 +- Made an RPM transparent change to move the sha1 canary check + file out of CVS and into the external lookaside cache (whose + filename changes with every new package release anyway...) + +* Fri Mar 17 2006 Greg Houlette - 1.2.8-2 +- Fixed architectural dependency during package creation eliminating + use of _libdir configure macro (x86_64 /usr/lib64 mis-targeting) + +* Tue Mar 7 2006 Greg Houlette - 1.2.8-1 +- New package version release +- reworked the .spec file to support optional dist tag +- Updated the application check default patchfile (chunk failure) +- Changed to SHA1 for optional message digest (canary check) +- Added a couple of suggested skip entries to rkhunter.conf + +* Sat Jun 11 2005 Greg Houlette - 1.2.7-1 +- Added signature auto-updating to CRON scan (new script) +- Removed BOOTSCAN pending rewrite to full SysV Init scan in background +- Added the --append-log command line option +- Added Date Stamping to output +- Fixed bug in /etc/group missing report +- New package version release + +* Sun Jan 2 2005 Greg Houlette - 0:1.1.9-1 +- New package version release +- Added the --run-application-check command line option + to listing in command help +- Replaced 'Here' Doc editing of rkhunter.conf file + with in-place Perl edit +- tweaked rpmbuild -bb Autoclean + +* Fri Oct 15 2004 Greg Houlette - 0:1.1.8-0.fdr.1 (revisited) +- Removed redundant buildrequires /bin/sh, coreutils and perl +- Revise postun scriptlet +- Added /usr/share/doc/rkhunter-1.1.8/ to files list + +* Mon Oct 11 2004 Greg Houlette - 0:1.1.8-0.fdr.1 +- Changed Release Tag to 0.fdr.1 (testing) for QA +- Removed wget from dependencies +- Hid (temporarily) the --skip-application-check command + line option from being listed in help +- Fixed the spec files list, again! + +* Fri Oct 8 2004 Greg Houlette - 0:1.1.8-0.fdr.0.2.beta2 +- Unified and disabled the md5 canary check in prep + (check is now optional) removing the sha1 cross-check +- Fixed the spec files list, adding the /var/rkhunter + directory and the /usr/bin/rkhunter executable +- Fixed missing dependencies (rkh uses runtime checks) +- Disabled "auto-clean" for rpmbuild -bb +- Changed Application version scan default to + disabled awaiting backport fix in upstream sources +- Fixed shared_man_search.patch, configuration files + verify and added postun(install) cleanup + +* Fri Oct 1 2004 Greg Houlette - 0:1.1.8-0.fdr.0.1.beta1 +- More cosmetic patchwork +- Changed Release Tag to beta1 (pre-release) for QA submit + +* Tue Sep 28 2004 Greg Houlette - 0:1.1.8-0.fdr.1 +- Removed hidden_search.patch (1.1.7) after it was + merged into upstream source by Michael Boelen +- Removed .spec file from md5 and sha1 file checks + (it must be modifiable by Fedora QA release build) +- Added BOOTSCAN description file to documentation +- Restructured dynamic file creation ('Here' Docs) + moving them to the "prep" stage so that *_ALL_* + files are available prior to the "build" stage + (for inspection purposes) +- Added a /etc/sysconfig/rkhunter parameters file + +* Sun Aug 29 2004 Greg Houlette - 0:1.1.7-0.fdr.1 +- Cosmetic patchwork + +* Sat Aug 21 2004 Greg Houlette - 0:1.1.6-0.fdr.1 +- Moderate reworking of .spec file for packaging standards +- Added md5 and sha1 file checks to prep procedure for source .rpm +- Included an optional rc.local replacement for scan on boot (with full logging) + +* Tue Aug 10 2004 Michael Boelen - 1.1.5 +- Added update script +- Extended description + +* Sun Aug 08 2004 Greg Houlette - 1.1.5 +- Changed the install procedure eliminating the specification of + destination filenames (only needed if you are renaming during install) +- Changed the permissions for documentation files (root only overkill) +- Added the installation of the rkhunter Man Page +- Added the installation of the programs_{bad, good}.dat database files +- Added the installation of the LICENSE documentation file +- Added the chmod for root only to the /var/rkhunter/db directory + +* Sun May 23 2004 Craig Orsinger (cjo) +- version 1.1.0-1.cjo +- changed installation in accordance with new rootkit installation + procedure +- changed installation root to conform to LSB. Use standard macros. +- added recursive remove of old build root as prep for install phase + +* Wed Apr 28 2004 Doncho N. Gunchev - 1.0.9-0.mr700 +- dropped Requires: perl - rkhunter works without it +- dropped the bash alignpatch (check the source or contact me) +- various file mode fixes (.../tmp/, *.db) +- optimized the %%files section - any new files in the + current dirs will be fine - just %%{__install} them. + +* Mon Apr 26 2004 Michael Boelen - 1.0.8-0 +- Fixed missing md5blacklist.dat + +* Mon Apr 19 2004 Doncho N. Gunchev - 1.0.6-1.mr700 +- added missing /usr/local/rkhunter/db/md5blacklist.dat +- patched to align results in --cronjob, I think rpm based + distros have symlink /bin/sh -> /bin/bash +- added --with/--without alignpatch for conditional builds + (in case previous patch breaks something) + +* Sat Apr 03 2004 Michael Boelen / Joe Klemmer - 1.0.6-0 +- Update to 1.0.6 + +* Mon Mar 29 2004 Doncho N. Gunchev - 1.0.0-0 +- initial .spec file diff --git a/rkhunter.sysconfig b/rkhunter.sysconfig new file mode 100644 index 0000000..2dacc41 --- /dev/null +++ b/rkhunter.sysconfig @@ -0,0 +1,10 @@ +# System configuration file for Rootkit Hunter which +# stores RPM system specifics for cron run, etc. +# +# MAILTO= +# DIAG_SCAN= no - perform normal report scan +# yes - perform detailed report scan +# (includes application check) + +MAILTO=root@localhost +DIAG_SCAN=no diff --git a/sources b/sources index e69de29..956755f 100644 --- a/sources +++ b/sources @@ -0,0 +1 @@ +SHA512 (rkhunter-1.4.6.tar.gz) = c51a21b6b66ed1f73a19d8ce04eaba35999eefcb666acc824989c3bf53ac56d24a33ac4fec290be942e33fe24674406b371eafff73f7e697b9e03ec031b37216 From f7872161798a15f762da01fb75c0595e143bba61 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 16 May 2020 14:18:22 -0700 Subject: [PATCH 3/5] Add allow for podman's /dev/shm files (fixes bug #1828698 ) --- rkhunter-1.4.6-fedoraconfig.patch | 10 ++++++---- rkhunter.spec | 5 ++++- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/rkhunter-1.4.6-fedoraconfig.patch b/rkhunter-1.4.6-fedoraconfig.patch index 4dbc624..e7631df 100644 --- a/rkhunter-1.4.6-fedoraconfig.patch +++ b/rkhunter-1.4.6-fedoraconfig.patch @@ -1,6 +1,6 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf --- rkhunter-1.4.6.orig/files/rkhunter.conf 2018-02-19 15:49:06.000000000 -0800 -+++ rkhunter-1.4.6/files/rkhunter.conf 2019-04-14 16:30:22.914740071 -0700 ++++ rkhunter-1.4.6/files/rkhunter.conf 2020-05-16 14:13:11.985468455 -0700 @@ -158,6 +158,7 @@ # default directory beneath the installation directory. # @@ -158,7 +158,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. # # Allow the specified process to use deleted files. The process name may be -@@ -714,6 +776,35 @@ +@@ -714,6 +776,37 @@ # #ALLOWDEVFILE=/dev/shm/pulse-shm-* #ALLOWDEVFILE=/dev/shm/sem.ADBE_* @@ -191,10 +191,12 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. +ALLOWDEVFILE=/dev/shm/qb-pengine-* +ALLOWDEVFILE=/dev/shm/qb-quorum-* +ALLOWDEVFILE=/dev/shm/qb-stonith-* ++# Allow podman ++ALLOWDEVFILE=/dev/shm/libpod*lock* # # Allow the specified process pathnames to use shared memory segments. -@@ -1090,6 +1181,11 @@ +@@ -1090,6 +1183,11 @@ # #RTKT_DIR_WHITELIST="" #RTKT_FILE_WHITELIST="" @@ -206,7 +208,7 @@ diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter. # # The following option can be used to whitelist shared library files that would -@@ -1329,3 +1425,5 @@ +@@ -1329,3 +1427,5 @@ # The default value is '0'. # #GLOBSTAR=0 diff --git a/rkhunter.spec b/rkhunter.spec index e627535..9f03ace 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -93,6 +93,9 @@ EOF %{_mandir}/man8/* %changelog +* Sat May 16 2020 Kevin Fenzi - 1.4.6-6 +- Add allow for podman's /dev/shm files (fixes bug #1828698 ) + * Fri Jul 26 2019 Fedora Release Engineering - 1.4.6-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild From e1f0253bc0be86390ab424f6a82c2e945e3fcda0 Mon Sep 17 00:00:00 2001 From: Troy Dawson Date: Thu, 24 Sep 2020 17:37:15 +0000 Subject: [PATCH 4/5] remove package.cfg per new epel-playground policy --- package.cfg | 2 -- 1 file changed, 2 deletions(-) delete mode 100644 package.cfg diff --git a/package.cfg b/package.cfg deleted file mode 100644 index 7e5a05b..0000000 --- a/package.cfg +++ /dev/null @@ -1,2 +0,0 @@ -[koji] -targets = epel8 epel8-playground From 89b6c54a9a1622d9a53e00478b7dda91b16739de Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Sat, 11 Jun 2022 10:12:02 -0700 Subject: [PATCH 5/5] Add patch to drop libkeys check, which is no longer needed on epel8 ( rhbz#2063310 ) --- rkhunter-1.4.6-drop-libkeyutils-check.patch | 43 +++++++++++++++++++++ rkhunter.spec | 7 +++- 2 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 rkhunter-1.4.6-drop-libkeyutils-check.patch diff --git a/rkhunter-1.4.6-drop-libkeyutils-check.patch b/rkhunter-1.4.6-drop-libkeyutils-check.patch new file mode 100644 index 0000000..b35ceaa --- /dev/null +++ b/rkhunter-1.4.6-drop-libkeyutils-check.patch @@ -0,0 +1,43 @@ +diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter +--- rkhunter-1.4.6.orig/files/rkhunter 2018-02-24 15:08:27.000000000 -0800 ++++ rkhunter-1.4.6/files/rkhunter 2021-01-15 12:47:54.399665856 -0800 +@@ -8370,9 +8370,7 @@ + /lib/libsbr.so + /lib64/libsbr.so + /lib/libslr.so +- /lib64/libslr.so +- /lib/tls/libkeyutils.so.1 +- /lib64/tls/libkeyutils.so.1" ++ /lib64/libslr.so" + EBURY_DIRS= + EBURY_KSYMS= + +@@ -9762,10 +9760,6 @@ + file:/usr/share/sshd.sync:Trojaned SSH daemon + file:/bin/zcut:Trojaned SSH daemon + file:/usr/bin/zmuie:Trojaned SSH daemon +- file:/lib/libkeyutils.so.1.9:Sniffer component +- file:/lib64/libkeyutils.so.1.9:Sniffer component +- file:/usr/lib/libkeyutils.so.1.9:Sniffer component +- file:/usr/lib64/libkeyutils.so.1.9:Sniffer component + file:/IptabLes:malware component + file:/.IptabLex:malware component + file:/boot/.IptabLex:malware component +@@ -9956,7 +9950,6 @@ + ssh-scan:Port scanner + atac:Port scanner component + \[pdflush\]:IRC bot +- libkeyutils.so.1.9:Spam tool component + .IptabLex:malware component + .IptabLes:malware component + .flush:malware component +diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb +--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb 2017-11-29 08:14:02.000000000 -0800 ++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb 1969-12-31 16:00:00.000000000 -0800 +@@ -1 +0,0 @@ +-RKH_libkeyutils.so.1.9-v1;Target:0;(((0&1&2)|(3&4&5))&((6&7&8)|(9&10)));58636174;58766572;58626e64;73686d6174;73686d6474;73686d676574;62696e64;636f6e6e656374;736f636b6574;737973636f6e66;746d7066696c65 +diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb +--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb 2017-11-29 08:14:02.000000000 -0800 ++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb 1969-12-31 16:00:00.000000000 -0800 +@@ -1 +0,0 @@ +-RKH_libkeyutils.1.9.so;Target:0;(0&1&2&3&4&5&6&7&8&9&10&11&12&13&14&15&16);737973636f6e66;746d7066696c65;77616974706964;736f636b6574;636f6e6e656374;73686d6174;73686d6474;73686d676574;73656d676574;73656d74696d65646f70;736c656570;737072696e7466;7372616e64;7374646f7574;737472636174;737472637079;5f5f737472647570 diff --git a/rkhunter.spec b/rkhunter.spec index 9f03ace..069c203 100644 --- a/rkhunter.spec +++ b/rkhunter.spec @@ -3,7 +3,7 @@ Name: rkhunter Version: 1.4.6 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits License: GPLv2+ @@ -12,6 +12,8 @@ Source0: http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.ta Source2: 01-rkhunter Source3: rkhunter.sysconfig Patch0: rkhunter-1.4.6-fedoraconfig.patch +# libkeyutils is an actual legit library now, so this old check is a false positive. +Patch1: rkhunter-1.4.6-drop-libkeyutils-check.patch BuildArch: noarch BuildRequires: perl-generators @@ -93,6 +95,9 @@ EOF %{_mandir}/man8/* %changelog +* Sat Jun 11 2022 Kevin Fenzi - 1.4.6-7 +- Add patch to drop libkeys check, which is no longer needed on epel8 ( rhbz#2063310 ) + * Sat May 16 2020 Kevin Fenzi - 1.4.6-6 - Add allow for podman's /dev/shm files (fixes bug #1828698 )