Add patch to find systemd-journald config and avoid warning. Fixes rhbz#2361203

Add patch to fix false positive on Li0n from bin/sbin merge. Fixes rhbz#2382304

.gitignore

@@ -0,0 +1,6 @@
+rkhunter-1.3.6.tar.gz
+/rkhunter-1.3.8.tar.gz
+/rkhunter-1.4.0.tar.gz
+/rkhunter-1.4.2.tar.gz
+/rkhunter-1.4.4.tar.gz
+/rkhunter-1.4.6.tar.gz

01-rkhunter

@@ -0,0 +1,57 @@
+#!/bin/sh
+# 01-rkhunter  A shell script to update and run rkhunter via CRON
+
+XITVAL=0
+
+# Get a secure tempfile
+TMPFILE1=`/bin/mktemp -p /var/lib/rkhunter rkhcronlog.XXXXXXXXXX` || exit 1
+
+if [ ! -e /var/lock/subsys/rkhunter ]; then
+
+  # Try to keep the SysInit boot scan from colliding with us (highly unlikely)
+  /bin/touch /var/lock/subsys/rkhunter
+
+  # Source system configuration parameters.
+  if [ -e /etc/sysconfig/rkhunter ] ; then
+    . /etc/sysconfig/rkhunter
+  else
+    MAILTO=root@localhost
+  fi
+
+  # If a diagnostic mode scan was requested, setup the parameters
+  if [ "$DIAG_SCAN" = "yes" ]; then
+    RKHUNTER_FLAGS="--checkall --skip-keypress --nocolors --quiet --appendlog --display-logfile"
+  else
+    RKHUNTER_FLAGS="--cronjob --nocolors --report-warnings-only"
+  fi
+
+  # Set a few critical parameters
+  RKHUNTER=/usr/bin/rkhunter
+  LOGFILE=/var/log/rkhunter/rkhunter.log
+
+  # Run RootKit Hunter if available
+  if [ -x $RKHUNTER ]; then
+    /bin/echo -e "\n--------------------- Start Rootkit Hunter Update ---------------------" \
+      > $TMPFILE1
+    /bin/nice -n 10 $RKHUNTER --update --nocolors 2>&1 >> $TMPFILE1
+    /bin/echo -e "\n---------------------- Start Rootkit Hunter Scan ----------------------" \
+      >> $TMPFILE1
+    /bin/nice -n 10 $RKHUNTER $RKHUNTER_FLAGS 2>&1 >> $TMPFILE1
+    XITVAL=$?
+    /bin/echo -e "\n----------------------- End Rootkit Hunter Scan -----------------------" \
+      >> $TMPFILE1
+
+    if [ $XITVAL != 0 ]; then
+         /bin/cat $TMPFILE1 | /bin/mail -s "rkhunter Daily Run on $(hostname)" $MAILTO
+    fi
+    /bin/cat $TMPFILE1 >> $LOGFILE
+  fi
+
+  # Delete the gating lockfile
+  /bin/rm -f /var/lock/subsys/rkhunter
+fi
+
+# Delete the secure tempfile
+/bin/rm -f $TMPFILE1
+
+exit $XITVAL

Makefile

@@ -1,21 +0,0 @@
-# Makefile for source rpm: rkhunter
-# $Id$
-NAME := rkhunter
-SPECFILE = $(firstword $(wildcard *.spec))
-
-define find-makefile-common
-for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
-endef
-
-MAKEFILE_COMMON	:= $(shell $(find-makefile-common))
-
-ifeq ($(MAKEFILE_COMMON),)
-# attept a checkout
-define checkout-makefile-common
-test -f CVS/Rootx && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
-endef
-
-MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
-endif
-
-include $(MAKEFILE_COMMON)

rkhunter-1.3.4.tar.gz.sha1.txt

@@ -0,0 +1,48 @@
+73a42c94be2fb1fd3284d8dc60d22ff0fc8407f4  rkhunter-1.3.4/files/WISHLIST
+c82074175e72642dd74322ce29281f0f2fe2798c  rkhunter-1.3.4/files/programs_bad.dat
+443431d6c4dde5ff474fc9521561c6858478ad81  rkhunter-1.3.4/files/rkhunter
+59de768a09a4cd13599653df85ecc2362e416ab3  rkhunter-1.3.4/files/defaulthashes.dat
+9203f315cf8ea90724f70595c0b8facd61169b4a  rkhunter-1.3.4/files/i18n/cn
+736fd9ea453f34c023a9ebed97fa0cea7461aeb8  rkhunter-1.3.4/files/i18n/zh.utf8
+3aa3999bd924382f2a7b7e52ad0c3f7834d2285c  rkhunter-1.3.4/files/i18n/zh
+a81ea7ee1677bb2f09c68ef55cac4819d102dfc0  rkhunter-1.3.4/files/i18n/en
+ff10891d252f3859abe63054eb64f0e9eae2d781  rkhunter-1.3.4/files/tools/README
+90876286c511986474144a5a1fc21afa0f5f29c5  rkhunter-1.3.4/files/tools/update_client.sh
+e3ba269e33d5d385230d0a4457d87cf6e3acece8  rkhunter-1.3.4/files/tools/update_server.sh
+98e225b334e319edaff76c079a3a241289ffa9c7  rkhunter-1.3.4/files/README
+ebc05604eb51b10478d35ac3750699cefecd5ae3  rkhunter-1.3.4/files/filehashmd5.pl
+d5bff919ce44a345a193824ea16b0404008d7823  rkhunter-1.3.4/files/programs_good.dat
+beed9c4b594c5be28ca4837fdcd2ac367e2946ee  rkhunter-1.3.4/files/contrib/run_rkhunter.sh
+225cc53f9691ad39f10bd2aaac478355ce4dc411  rkhunter-1.3.4/files/contrib/README.txt
+285155f63cfa7a6a73ec0352dccaaa2221989b94  rkhunter-1.3.4/files/contrib/rkhunter_remote_howto.txt
+56bf42d4fe669412b84eb307d5e314af4501dc9a  rkhunter-1.3.4/files/testing/stringscanner.sh
+361ada5406c7e57e62e840caf3d3bce5e8436fc1  rkhunter-1.3.4/files/testing/rootkitinfo.txt
+73e76916a3f65dde2317fff6c932e1d77760fdf7  rkhunter-1.3.4/files/testing/rkhunter.conf
+1878119b6045eeab6a5afaebad7b523e86c3a935  rkhunter-1.3.4/files/filehashsha1.pl
+a656a91b37a83a2325843f0ccedb5eb7866506ac  rkhunter-1.3.4/files/mirrors.dat
+9ddeec64999f4c0e6f9aa5992cd25c503311b764  rkhunter-1.3.4/files/backdoorports.dat
+a0badd192cc4f33fbf38f446eae3c858ba81c88f  rkhunter-1.3.4/files/check_modules.pl
+82c8c3881d59d228de3ce74a4b7b68eac07940f1  rkhunter-1.3.4/files/md5blacklist.dat
+4510d2228e144f80d75caef01c172095b2b4c24b  rkhunter-1.3.4/files/rkhunter.conf
+5c4319fe3f9acc552b7a9e973b7d081f7cb31642  rkhunter-1.3.4/files/check_port.pl
+f50ab02e29a0f4eba0ebe698f2c750a3b0298009  rkhunter-1.3.4/files/CHANGELOG
+951b498f71fc4a126ca435f7bce96ed8b821efb6  rkhunter-1.3.4/files/os.dat
+996a29dee608374e601ecf0253e445e16506c672  rkhunter-1.3.4/files/check_update.sh
+2e971f1c9f355d2172db3c5a33601b7037853ac1  rkhunter-1.3.4/files/FAQ
+7fa41ed0dc8c95b48b04dab42f1eaf8031c6ce7c  rkhunter-1.3.4/files/ACKNOWLEDGMENTS
+5dfa5246dc1c87b05f44f9f444466ce3d0d6edec  rkhunter-1.3.4/files/stat.pl
+345ab306455525cf5626caadda22b5dcbf732bc1  rkhunter-1.3.4/files/LICENSE
+5fc098260380362a515d32376e8d5522f1ccf716  rkhunter-1.3.4/files/readlink.sh
+e158163bfe6cb414d839e91880af37611f8b5cc0  rkhunter-1.3.4/files/development/createfilehashes.pl
+0c613880f3447af695ca9f9f93e158b34c2a10c3  rkhunter-1.3.4/files/development/osinformation.sh
+7378fb7e91b1f7e789508e4e8d00e1e3a70ee6ff  rkhunter-1.3.4/files/development/search_dead_sysmlinks.sh
+d09ab61a3563122b8cd6415e3083dfe1ef285a2b  rkhunter-1.3.4/files/development/i18nchk
+cb4903c649ad50b79230f5a5250da82c1d9ccb0f  rkhunter-1.3.4/files/development/createhashes.sh
+4f4dfb87e758236cadc5ac5af67bbb35f4f63eb1  rkhunter-1.3.4/files/development/rpmprelinkhashes.sh
+6b2f032d6143ed3b6ba3eae19d7921e154e69e47  rkhunter-1.3.4/files/development/createhashesall.sh
+614a5d3999055a8faeecc393c5695d628e5a7675  rkhunter-1.3.4/files/development/rpmhashes.sh
+ec4d60774decbb354f7aafcc2b65b1f87e000c97  rkhunter-1.3.4/files/suspscan.dat
+0b0c2b2b1e6342ada9b1df48cda550e5120f0cdf  rkhunter-1.3.4/files/rkhunter.8
+43bca835d9c64ab2f8cf7f1a5a078bb1b7da9306  rkhunter-1.3.4/files/showfiles.pl
+21d8c152e81061d37d122e3a82283448cd267e73  rkhunter-1.3.4/files/rkhunter.spec
+0093470e31268c538ecacc803969819faf742dde  rkhunter-1.3.4/installer.sh

rkhunter-1.4.6-Li0n-fix.patch

@@ -0,0 +1,13 @@
+diff --color -Nur rkhunter-1.4.6/files/rkhunter rkhunter-1.4.6-build/rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6/files/rkhunter	2026-01-03 10:15:00.159046977 -0800
++++ rkhunter-1.4.6/files/rkhunter	2026-01-03 10:22:54.440297219 -0800
+@@ -8680,8 +8680,7 @@
+ 
+ 
+ 	# Lion Worm
+-	LION_FILES="/bin/in.telnetd
+-		    /bin/mjy
++	LION_FILES="/bin/mjy
+ 		    /usr/man/man1/man1/lib/.lib/mjy
+ 		    /usr/man/man1/man1/lib/.lib/in.telnetd
+ 		    /usr/man/man1/man1/lib/.lib/.x

rkhunter-1.4.6-drop-libkeyutils-check.patch

@@ -0,0 +1,43 @@
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6.orig/files/rkhunter	2018-02-24 15:08:27.000000000 -0800
++++ rkhunter-1.4.6/files/rkhunter	2021-01-15 12:47:54.399665856 -0800
+@@ -8370,9 +8370,7 @@
+ 		     /lib/libsbr.so
+ 		     /lib64/libsbr.so
+ 		     /lib/libslr.so
+-		     /lib64/libslr.so
+-		     /lib/tls/libkeyutils.so.1
+-		     /lib64/tls/libkeyutils.so.1"
++		     /lib64/libslr.so"
+ 	EBURY_DIRS=
+ 	EBURY_KSYMS=
+ 
+@@ -9762,10 +9760,6 @@
+ 		  file:/usr/share/sshd.sync:Trojaned SSH daemon
+ 		  file:/bin/zcut:Trojaned SSH daemon
+ 		  file:/usr/bin/zmuie:Trojaned SSH daemon
+-		  file:/lib/libkeyutils.so.1.9:Sniffer component
+-		  file:/lib64/libkeyutils.so.1.9:Sniffer component
+-		  file:/usr/lib/libkeyutils.so.1.9:Sniffer component
+-		  file:/usr/lib64/libkeyutils.so.1.9:Sniffer component
+ 		  file:/IptabLes:malware component
+ 		  file:/.IptabLex:malware component
+ 		  file:/boot/.IptabLex:malware component
+@@ -9956,7 +9950,6 @@
+ 			 ssh-scan:Port scanner
+ 			 atac:Port scanner component
+ 			 \[pdflush\]:IRC bot
+-			 libkeyutils.so.1.9:Spam tool component
+ 			 .IptabLex:malware component
+ 			 .IptabLes:malware component
+ 			 .flush:malware component
+diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb
+--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb	2017-11-29 08:14:02.000000000 -0800
++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb	1969-12-31 16:00:00.000000000 -0800
+@@ -1 +0,0 @@
+-RKH_libkeyutils.so.1.9-v1;Target:0;(((0&1&2)|(3&4&5))&((6&7&8)|(9&10)));58636174;58766572;58626e64;73686d6174;73686d6474;73686d676574;62696e64;636f6e6e656374;736f636b6574;737973636f6e66;746d7066696c65
+diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb
+--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb	2017-11-29 08:14:02.000000000 -0800
++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb	1969-12-31 16:00:00.000000000 -0800
+@@ -1 +0,0 @@
+-RKH_libkeyutils.1.9.so;Target:0;(0&1&2&3&4&5&6&7&8&9&10&11&12&13&14&15&16);737973636f6e66;746d7066696c65;77616974706964;736f636b6574;636f6e6e656374;73686d6174;73686d6474;73686d676574;73656d676574;73656d74696d65646f70;736c656570;737072696e7466;7372616e64;7374646f7574;737472636174;737472637079;5f5f737472647570

rkhunter-1.4.6-fedoraconfig.patch

@@ -0,0 +1,220 @@
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf
+--- rkhunter-1.4.6.orig/files/rkhunter.conf	2018-02-19 15:49:06.000000000 -0800
++++ rkhunter-1.4.6/files/rkhunter.conf	2022-06-11 09:58:09.740944517 -0700
+@@ -158,6 +158,7 @@
+ # default directory beneath the installation directory.
+ #
+ #TMPDIR=/var/lib/rkhunter/tmp
++TMPDIR=/var/lib/rkhunter
+ 
+ #
+ # This option specifies the database directory to use.
+@@ -167,6 +168,7 @@
+ # default directory beneath the installation directory.
+ #
+ #DBDIR=/var/lib/rkhunter/db
++DBDIR=/var/lib/rkhunter/db
+ 
+ #
+ # This option specifies the script directory to use.
+@@ -175,6 +177,7 @@
+ # subsequently commented out or removed, then the program will not run.
+ #
+ #SCRIPTDIR=/usr/local/lib/rkhunter/scripts
++SCRIPTDIR=/usr/share/rkhunter/scripts
+ 
+ #
+ # This option can be used to modify the command directory list used by rkhunter
+@@ -231,7 +234,7 @@
+ #
+ # The default value is '/var/log/rkhunter.log'.
+ #
+-LOGFILE=/var/log/rkhunter.log
++LOGFILE=/var/log/rkhunter/rkhunter.log
+ 
+ #
+ # Set this option to '1' if the log file is to be appended to whenever rkhunter
+@@ -241,6 +244,7 @@
+ # The default value is '0'.
+ #
+ #APPEND_LOG=0
++APPEND_LOG=1
+ 
+ #
+ # Set the following option to '1' if the log file is to be copied when rkhunter
+@@ -307,6 +311,7 @@
+ # The default value is 'no'.
+ #
+ #ALLOW_SSH_ROOT_USER=no
++ALLOW_SSH_ROOT_USER=unset
+ 
+ #
+ # Set this option to '1' to allow the use of the SSH-1 protocol, but note
+@@ -321,6 +326,7 @@
+ # The default value is '0'.
+ #
+ #ALLOW_SSH_PROT_V1=0
++ALLOW_SSH_PROT_V1=2
+ 
+ #
+ # This setting tells rkhunter the directory containing the SSH configuration
+@@ -353,7 +359,8 @@
+ # program defaults.
+ #
+ ENABLE_TESTS=ALL
+-DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps
++#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps
++DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps ipc_shared_mem
+ 
+ #
+ # The HASH_CMD option can be used to specify the command to use for the file
+@@ -435,6 +442,7 @@
+ # Also see the PKGMGR_NO_VRFY and USE_SUNSUM options.
+ #
+ #PKGMGR=NONE
++PKGMGR=RPM
+ 
+ #
+ # It is possible that a file, which is part of a package, may have been
+@@ -558,6 +566,17 @@
+ # The default value is the null string.
+ #
+ #EXISTWHITELIST=""
++EXISTWHITELIST=/bin/ad
++# FreeIPA Certificate Authority
++EXISTWHITELIST=/var/log/pki-ca/system
++# FreeIPA Certificate Authority
++EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system
++# FreeIPA with KRA (Password Vault)
++EXISTWHITELIST=/var/log/pki/pki-tomcat/kra/system
++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/kra/system
++# Some non default installed files we check
++EXISTWHITELIST=/usr/bin/GET
++EXISTWHITELIST=/usr/bin/whatis
+ 
+ #
+ # Whitelist various attributes of the specified file. The attributes are those
+@@ -588,6 +607,10 @@
+ # The default value is the null string.
+ #
+ #SCRIPTWHITELIST=/usr/bin/groups
++SCRIPTWHITELIST=/usr/bin/whatis
++SCRIPTWHITELIST=/usr/bin/ldd
++SCRIPTWHITELIST=/usr/bin/groups
++SCRIPTWHITELIST=/usr/bin/GET
+ 
+ #
+ # Allow the specified file to have the immutable attribute set.
+@@ -630,6 +653,19 @@
+ #ALLOWHIDDENDIR=/dev/.udev
+ #ALLOWHIDDENDIR=/dev/.udevdb
+ #ALLOWHIDDENDIR=/dev/.mdadm
++ALLOWHIDDENDIR="/etc/.java"
++ALLOWHIDDENDIR=/dev/.udev
++ALLOWHIDDENDIR=/dev/.udevdb
++ALLOWHIDDENDIR=/dev/.udev.tdb
++ALLOWHIDDENDIR=/dev/.static
++ALLOWHIDDENDIR=/dev/.initramfs
++ALLOWHIDDENDIR=/dev/.SRC-unix
++ALLOWHIDDENDIR=/dev/.mdadm
++ALLOWHIDDENDIR=/dev/.systemd
++ALLOWHIDDENDIR=/dev/.mount
++# for etckeeper
++ALLOWHIDDENDIR=/etc/.git
++ALLOWHIDDENDIR=/etc/.bzr
+ 
+ #
+ # Allow the specified hidden file to be whitelisted.
+@@ -645,6 +681,36 @@
+ #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
+ #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
+ #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
++ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz"
++ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac
++ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac
++ALLOWHIDDENFILE=/usr/bin/.fipscheck.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-keygen.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-keyscan.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-add.hmac
++ALLOWHIDDENFILE=/usr/bin/.ssh-agent.hmac
++ALLOWHIDDENFILE=/usr/lib*/.libfipscheck.so.*.hmac
++ALLOWHIDDENFILE=/usr/lib*/.libgcrypt.so.*.hmac
++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha1hmac.hmac
++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha256hmac.hmac
++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha384hmac.hmac
++ALLOWHIDDENFILE=/usr/lib*/hmaccalc/sha512hmac.hmac
++ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
++ALLOWHIDDENFILE=/dev/.mdadm.map
++ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz
++ALLOWHIDDENFILE=/usr/share/man/man5/.k5identity.5.gz
++ALLOWHIDDENFILE=/usr/sbin/.ipsec.hmac
++# etckeeper
++ALLOWHIDDENFILE=/etc/.etckeeper
++ALLOWHIDDENFILE=/etc/.gitignore
++ALLOWHIDDENFILE=/etc/.bzrignore
++# systemd
++ALLOWHIDDENFILE=/etc/.updated
++# containers-common
++ALLOWHIDDENFILE=/usr/share/man/man5/.containerignore.5.gz
++# containers-common (older versions)
++ALLOWHIDDENFILE=/usr/share/man/man5/.dockerignore.5.gz
+ 
+ #
+ # Allow the specified process to use deleted files. The process name may be
+@@ -714,6 +780,37 @@
+ #
+ #ALLOWDEVFILE=/dev/shm/pulse-shm-*
+ #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
++ALLOWDEVFILE=/dev/shm/pulse-shm-*
++ALLOWDEVFILE=/dev/md/md-device-map
++# tomboy creates this one
++ALLOWDEVFILE="/dev/shm/mono.*"
++# created by libv4l
++ALLOWDEVFILE="/dev/shm/libv4l-*"
++# created by spice video
++ALLOWDEVFILE="/dev/shm/spice.*"
++# created by mdadm
++ALLOWDEVFILE="/dev/md/autorebuild.pid"
++# 389 Directory Server
++ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats
++# squid proxy
++ALLOWDEVFILE=/dev/shm/squid-cf*
++# squid ssl cache
++ALLOWDEVFILE=/dev/shm/squid-ssl_session_cache.shm
++# allow lldpad state file
++ALLOWDEVFILE=/dev/shm/lldpad.state
++# Allow PCS/Pacemaker/Corosync
++ALLOWDEVFILE=/dev/shm/qb-attrd-*
++ALLOWDEVFILE=/dev/shm/qb-cfg-*
++ALLOWDEVFILE=/dev/shm/qb-cib_rw-*
++ALLOWDEVFILE=/dev/shm/qb-cib_shm-*
++ALLOWDEVFILE=/dev/shm/qb-corosync-*
++ALLOWDEVFILE=/dev/shm/qb-cpg-*
++ALLOWDEVFILE=/dev/shm/qb-lrmd-*
++ALLOWDEVFILE=/dev/shm/qb-pengine-*
++ALLOWDEVFILE=/dev/shm/qb-quorum-*
++ALLOWDEVFILE=/dev/shm/qb-stonith-*
++# Allow podman
++ALLOWDEVFILE=/dev/shm/libpod*lock*
+ 
+ #
+ # Allow the specified process pathnames to use shared memory segments.
+@@ -1090,6 +1187,11 @@
+ #
+ #RTKT_DIR_WHITELIST=""
+ #RTKT_FILE_WHITELIST=""
++RTKT_FILE_WHITELIST=/bin/ad
++# FreeIPA Certificate Authority
++RTKT_FILE_WHITELIST=/var/log/pki-ca/system
++# FreeIPA Certificate Authority
++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/ca/system
+ 
+ #
+ # The following option can be used to whitelist shared library files that would
+@@ -1329,3 +1431,5 @@
+ # The default value is '0'.
+ #
+ #GLOBSTAR=0
++
++INSTALLDIR="/usr"

rkhunter-1.4.6-grep-fix.patch

@@ -0,0 +1,21 @@
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6.orig/files/rkhunter	2025-05-04 10:41:26.009520652 -0700
++++ rkhunter-1.4.6/files/rkhunter	2025-05-04 10:37:49.439199695 -0700
+@@ -6691,7 +6691,7 @@
+ 					#
+ 
+ 					if [ $ERRCODE -eq 1 -a $BINISLINK -eq 1 ]; then
+-						if [ -n "`echo \"$FNAME\" | grep '^\/usr\/'`" ]; then
++						if [ -n "`echo \"$FNAME\" | grep '^/usr/'`" ]; then
+ 							RKHTMPVAR3=`echo "$FNAMEGREP" | sed -e 's:^/usr::'`
+ 						else
+ 							RKHTMPVAR3="/usr${FNAMEGREP}"
+@@ -11005,7 +11005,7 @@
+ 						#
+ 
+ 						if [ $ERRCODE -eq 1 -a $BINISLINK -eq 1 ]; then
+-							if [ -n "`echo \"${FNAME}\" | grep '^\/usr\/'`" ]; then
++							if [ -n "`echo \"${FNAME}\" | grep '^/usr/'`" ]; then
+ 								RKHTMPVAR3=`echo "${FNAMEGREP}" | sed -e 's:^/usr::'`
+ 							else
+ 								RKHTMPVAR3="/usr${FNAMEGREP}"

rkhunter-1.4.6-grep.patch

@@ -0,0 +1,35 @@
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6.orig/files/rkhunter	2023-04-29 09:32:39.288709203 -0700
++++ rkhunter-1.4.6/files/rkhunter	2023-04-29 10:00:29.396271053 -0700
+@@ -70,7 +70,7 @@
+ # we exec to log everything to the debug file.
+ #
+ 
+-if [ -n "`echo \"$*\" | grep '\-\-debug'`" ]; then
++if [ -n "`echo \"$*\" | grep '\--debug'`" ]; then
+ 	RKHDEBUGFILE=""
+ 	RKHDEBUGBASE="/tmp/rkhunter-debug"
+ 
+@@ -181,9 +181,11 @@
+ # used. If it is, then some typical grep tests will fail.
+ #
+ 
+-if [ "`echo \"rkh-grep-test\" | grep '^\+'`" = "rkh-grep-test" ]; then
++# fedora always uses POSIX grep and set an alias here for depreciated egrep too
++#if [ "`echo \"rkh-grep-test\" | grep '^\+'`" = "rkh-grep-test" ]; then
+ 	alias grep='grep -E'
+-fi
++	alias egrep='grep -E'
++#fi
+ 
+ 
+ #
+@@ -9585,7 +9587,7 @@
+ 		    rpc.nfsd:tcp.log:Sniffer installed
+ 		    sshd:/dev/ptyxx:OpenBSD Rootkit
+ 		    sshd:/.config:SHV4 Rootkit
+-		    sshd:+\\$.*\\$\!.*\!\!\\$:Backdoored SSH daemon installed
++		    sshd:+\\$.*\\$!.*!!\\$:Backdoored SSH daemon installed
+ 		    sshd:backdoor.h:Trojaned SSH daemon
+ 		    sshd:backdoor_active:Trojaned SSH daemon
+ 		    sshd:magic_pass_active:Trojaned SSH daemon

rkhunter-1.4.6-journald-config.patch

@@ -0,0 +1,12 @@
+diff --color -Nur rkhunter-1.4.6/files/rkhunter rkhunter-1.4.6-build/rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6/files/rkhunter	2026-01-03 10:15:00.159046977 -0800
++++ rkhunter-1.4.6/files/rkhunter	2026-01-03 10:18:12.190029798 -0800
+@@ -17615,7 +17615,7 @@
+ 		#
+ 
+ 		if [ -z "${SYSLOG_CONFIG_FILE}" ]; then
+-			SYSLOG_CONFIG_FILE="/etc/syslog.conf /etc/rsyslog.conf /etc/syslog-ng/syslog-ng.conf /etc/systemd/journald.conf /etc/systemd/systemd-journald.conf"
++			SYSLOG_CONFIG_FILE="/etc/syslog.conf /etc/rsyslog.conf /etc/syslog-ng/syslog-ng.conf /etc/systemd/journald.conf /etc/systemd/systemd-journald.conf /usr/lib/systemd/journald.conf"
+ 		fi
+ 
+ 		if [ "${SYSLOG_CONFIG_FILE}" = "NONE" ]; then

rkhunter-1.4.6-ssh.d.patch

@@ -0,0 +1,43 @@
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6.orig/files/rkhunter	2021-02-07 13:58:43.355270731 -0800
++++ rkhunter-1.4.6/files/rkhunter	2021-02-07 14:02:41.551554134 -0800
+@@ -17379,6 +17379,12 @@
+ 			fi
+ 		done
+ 
++			if [ -d "${SSH_CONFIG_FILE}.d" ];then
++				SSH_CONFIG_FILE="${SSH_CONFIG_FILE} ${SSH_CONFIG_FILE}.d/*"
++			else
++				:
++			fi
++
+ 		if [ -n "${SSH_CONFIG_FILE}" ]; then
+ 			display --to SCREEN+LOG --type PLAIN --result FOUND --color GREEN --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_FILE_SSH
+ 
+@@ -17396,7 +17402,7 @@
+ 			# First we check for allowed root access.
+ 			#
+ 
+-			RKHTMPVAR=`grep -i '^[ 	]*PermitRootLogin[ 	=]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1`
++			RKHTMPVAR=`grep -ih '^[         ]*PermitRootLogin[      =]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+ 				#
+@@ -17427,7 +17433,7 @@
+ 			# Next we check to see if protocol version 1 is allowed.
+ 			#
+ 
+-			RKHTMPVAR=`grep -i '^[ 	]*Protocol[ 	=]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1`
++			RKHTMPVAR=`grep -i '^[ 	]*Protocol[ 	=]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+ 				#
+@@ -17467,7 +17473,7 @@
+ 			# First check for the Ebury backdoor.
+ 			#
+ 
+-			RKHTMPVAR=`grep -i '^[ 	]*AuthorizedKeysFile[ 	=]' "${SSH_CONFIG_FILE}" 2>/dev/null | tail ${TAIL_OPT}1`
++			RKHTMPVAR=`grep -i '^[ 	]*AuthorizedKeysFile[ 	=]' ${SSH_CONFIG_FILE} 2>/dev/null | tail ${TAIL_OPT}1`
+ 
+ 			if [ -n "${RKHTMPVAR}" ]; then
+ 				RKHTMPVAR2=`echo ${RKHTMPVAR} | sed -e 's/^[^ 	=]*[ 	]*=*[ 	]*\([^ 	#]*\).*$/\1/'`

rkhunter.spec

@@ -0,0 +1,561 @@
+# In f20+ use unversioned docdirs, otherwise the old versioned one
+%{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
+
+Name:           rkhunter
+Version:        1.4.6
+Release:        31%{?dist}
+Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
+
+# Automatically converted from old format: GPLv2+ - review is highly recommended.
+License:        GPL-2.0-or-later
+URL:            http://rkhunter.sourceforge.net/
+Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz
+Source2:        01-rkhunter
+Source3:        rkhunter.sysconfig
+Patch0:         rkhunter-1.4.6-fedoraconfig.patch
+# libkeyutils is an actual legit library now, so this old check is a false positive.
+Patch1:         rkhunter-1.4.6-drop-libkeyutils-check.patch
+# have ssh checks use the sshd.d directoy config files too.
+Patch2:         rkhunter-1.4.6-ssh.d.patch
+# Fix grep/egrep changes in f38+
+Patch3:         rkhunter-1.4.6-grep.patch
+# Fix grep warning about escaping / in f42+
+Patch4:         rkhunter-1.4.6-grep-fix.patch
+# Fix systemd-journald config path
+Patch5:         rkhunter-1.4.6-journald-config.patch
+# Fix false positive Li0n detection due to bin/sbin merge
+Patch6:         rkhunter-1.4.6-Li0n-fix.patch
+BuildArch:      noarch
+BuildRequires:      perl-generators
+
+Requires:       coreutils, binutils, kmod, findutils, grep
+Requires:       e2fsprogs, procps, lsof, iproute, wget
+Requires:       perl-interpreter, perl(strict), perl(IO::Socket), s-nail, logrotate
+Requires:       crontabs
+
+%description
+Rootkit Hunter (RKH) is an easy-to-use tool which checks
+computers running UNIX (clones) for the presence of rootkits
+and other unwanted tools.
+
+%prep
+
+%autosetup -p1
+
+%{__cat} <<'EOF' >%{name}.logrotate
+%{_localstatedir}/log/%{name}/%{name}.log {
+    weekly
+    notifempty
+    create 640 root root
+}
+EOF
+
+%build
+# Nothing to be built
+
+%install
+%{__rm} -rf $RPM_BUILD_ROOT
+
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_bindir}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_sysconfdir}/{cron.daily,sysconfig,logrotate.d}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8
+%{__mkdir} -m700 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/log/%{name}
+%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n
+
+%{__install} -m755 -p files/%{name}             ${RPM_BUILD_ROOT}%{_bindir}/
+
+%{__install} -m644 -p files/backdoorports.dat   ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
+%{__install} -m644 -p files/mirrors.dat         ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
+%{__install} -m644 -p files/programs_bad.dat    ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/
+%{__install} -m644 -p files/i18n/cn             ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n/
+%{__install} -m644 -p files/i18n/en             ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n/
+
+%{__install} -m644 -p files/CHANGELOG           ${RPM_BUILD_ROOT}%{_pkgdocdir}
+%{__install} -m644 -p files/LICENSE             ${RPM_BUILD_ROOT}%{_pkgdocdir}
+%{__install} -m644 -p files/README              ${RPM_BUILD_ROOT}%{_pkgdocdir}
+%{__install} -m755 -p files/check_modules.pl    ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/
+%{__install} -m644 -p files/*.8                 ${RPM_BUILD_ROOT}%{_mandir}/man8/
+# Don't ship these unless we want to Require the perl modules
+#%{__install} -m750 -p files/filehashmd5.pl      ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
+#%{__install} -m750 -p files/filehashsha1.pl     ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/
+%{__install} -m755 -p %{SOURCE2}                ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/%{name}
+%{__install} -m644 -p %{name}.logrotate         ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/%{name}
+%{__install} -m640 -p files/%{name}.conf        ${RPM_BUILD_ROOT}%{_sysconfdir}/
+%{__install} -m640 -p %{SOURCE3}                ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name}
+
+%files
+%doc %{_pkgdocdir}/*
+%{_bindir}/%{name}
+%dir %{_datadir}/%{name}
+%{_datadir}/%{name}/scripts
+%{_sysconfdir}/cron.daily/%{name}
+%config(noreplace) %{_sysconfdir}/logrotate.d/%{name}
+%dir %{_var}/lib/%{name}
+%dir %{_var}/lib/%{name}/db
+%ghost %{_var}/lib/%{name}/db/mirrors.dat
+%ghost %{_var}/lib/%{name}/db/programs_bad.dat
+%ghost %{_var}/lib/%{name}/db/backdoorports.dat
+%{_var}/lib/%{name}/db/i18n
+%dir %{_var}/log/%{name}
+%config(noreplace) %{_sysconfdir}/%{name}.conf
+%config(noreplace) %{_sysconfdir}/sysconfig/%{name}
+%dir %{_pkgdocdir}
+%{_mandir}/man8/*
+
+%changelog
+* Sat Jan 03 2026 Kevin Fenzi <kevin@scrye.com> - 1.4.6-31
+- Add patch to find systemd-journald config and avoid warning. Fixes rhbz#2361203
+- Add patch to fix false positive on Li0n from bin/sbin merge. Fixes rhbz#2382304
+
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-30
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Sun May 04 2025 Kevin Fenzi <kevin@scrye.com> - 1.4.6-29
+- Add fix for additional case of grep warnings with cron.
+
+* Sat Apr 19 2025 Kevin Fenzi <kevin@scrye.com> - 1.4.6-28
+- Add a fix to grep warning about escaping /s. Fixes rhbz#2360502
+
+* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-27
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Fri Jul 26 2024 Miroslav Suchý <msuchy@redhat.com> - 1.4.6-26
+- convert license to SPDX
+
+* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-25
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-24
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-23
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-22
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Sat Apr 29 2023 Kevin Fenzi <kevin@scrye.com> - 1.4.6-21
+- More complete fix for egrep changes.
+
+* Mon Apr 10 2023 Kevin Fenzi <kevin@scrye.com> - 1.4.6-20
+- Patch grep/egrep changes to avoid warnings in F38+
+
+* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-19
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-18
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Sun Jun 19 2022 Kevin Fenzi <kevin@scrye.com> - 1.4.6-17
+- Switch to using s-nail instead of mailx.
+
+* Sat Jun 11 2022 Kevin Fenzi <kevin@scrye.com> - 1.4.6-16
+- Whitelist .dockerignore man page ( rhbz#2050551 )
+
+* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
+* Sat Nov 06 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-14
+- Add exclude for containers-common man page ( rhbz#2020015 )
+
+* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
+* Sun Feb 07 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-12
+- Fix bug around ssh protocol detection ( rhbz#1597635 )
+
+* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
+
+* Sat Jan 16 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-10
+- Drop check on libkeyutils, it's a legit library now. Fixes rhbz#1914662
+- Look for and use the ssh.d config snippet direction. Thanks John Dodson for patch. Fixes rhbz#1851620
+
+* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-9
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Sat May 16 2020 Kevin Fenzi <kevin@scrye.com> - 1.4.6-8
+- Add allow for podman's /dev/shm files (fixes bug #1828698 )
+
+* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Sun Oct 06 2019 Kevin Fenzi <kevin@scrye.com> - 1.4.6-6
+- Adjust config for PermitRootLogin change in f31+. Fixes bug #1756593
+
+* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Sun Apr 14 2019 Kevin Fenzi <kevin@scrye.com> - 1.4.6-4
+- Drop ifup/ifdown since network-scripts is now deprecated. Fixes bug #1698920
+
+* Sat Feb 02 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.6-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Sun Feb 25 2018 Kevin Fenzi <kevin@scrye.com> - 1.4.6-1
+- Update to 1.4.6. Fixes bug #1547315
+- Allow KRA vault log files. Fixes bug #1541472
+- ipc_shared_mem warning fixed upstream. Fixes bug #1524456
+
+* Fri Feb 09 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 1.4.4-6
+- Escape macros in %%changelog
+
+* Mon Nov 27 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-5
+- Add fix for new rpm queryformat and ARCH. Fixes bug #1517387
+
+* Sat Aug 12 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-4
+- Disable ipc_shared_mem test for now due to false positives. Bug #1472299
+
+* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.4-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Thu Jul 13 2017 Petr Pisar <ppisar@redhat.com> - 1.4.4-2
+- perl dependency renamed to perl-interpreter
+  <https://fedoraproject.org/wiki/Changes/perl_Package_to_Install_Core_Modules>
+
+* Thu Jun 29 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-1
+- Update to 1.4.4. Fixes bug #1466318
+- Fix for logger and spaces. Fixes bug #1284403
+
+* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.2-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Wed Jan 25 2017 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-12
+- Add /dev/shm/qb* files to whitelist. Fixes bug #1403602
+- Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug #1411130
+
+* Wed Apr 20 2016 Kevin Fenzi <kevin@scrye.com> - 1.4.2-11
+- Add /dev/shm/lldpad files to whitelist. Fixes bug #1293059
+
+* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.4.2-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Sun Dec 06 2015 Kevin Fenzi <kevin@scrye.com> - 1.4.2-9
+- Add /dev/shm/squid files to whitelist. Fixes bug #1279632
+
+* Tue Oct 13 2015 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-8
+- Change config patch to account for change in default SSH config
+
+* Thu Jun 18 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.2-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Sat Dec 20 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-6
+- Add /etc/.updated systemd file to whitelist. Fixes bug #1173481
+- Add patch to fix grep -a issue with too many arguments output. 
+
+* Mon Oct 27 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-5
+- Set /var/lib/rkhunter to be mode 700. fixes bug #1154428
+
+* Fri Sep 26 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-4
+- Fix cron script to work with non bash shells. Fixes bug #1146717
+
+* Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Sun Apr 06 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-2
+- Add patch to fix ipcs command in non en locales
+- Add config to fix freeipa installs. Fixes bug #994567
+
+* Fri Mar 14 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-1
+- Update to 1.4.2
+
+* Sun Sep 01 2013 Kevin Fenzi <kevin@scrye.com> 1.4.0-9
+- Add patch for now to help spaces in allowdev file handling. Fixes bug #984180
+
+* Sat Aug 03 2013 Petr Pisar <ppisar@redhat.com> - 1.4.0-9
+- Perl 5.18 rebuild
+
+* Sat Jul 27 2013 Kevin Fenzi <kevin@scrye.com> 1.4.0-8
+- Fix for unversioned docs
+- Requires: crontabs. Fixes bug #989110
+
+* Wed Jul 17 2013 Petr Pisar <ppisar@redhat.com> - 1.4.0-7
+- Perl 5.18 rebuild
+
+* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.0-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
+
+* Sat Oct 06 2012 Kevin Fenzi <kevin@scrye.com> 1.4.0-5
+- Add /dev/md/autorebuild.pid to whitelist. Fixes bug #857315
+
+* Sat Aug 18 2012 Kevin Fenzi <kevin@scrye.com> 1.4.0-4
+- Add /var/log/pki-ca/system to whitelist for FreeIPA. Fixes bug #849251
+
+* Wed Aug 15 2012 Kevin Fenzi <kevin@scrye.com> 1.4.0-3
+- Fix /bin/ad false positive. Fixes bug #831989
+
+* Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.0-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
+* Tue May 08 2012 Kevin Fenzi <kevin@scrye.com> - 1.4.0-1
+- Update to 1.4.0
+
+* Sun Apr 15 2012 Kevin Fenzi <kevin@scrye.com> - 1.3.8-15
+- Add workaround for /lib/java false positive. Fixes bug #806972
+
+* Wed Feb  8 2012 Kay Sievers <kay@redhat.com> - 1.3.8-14
+- modutils are for Linux 2.4 and no longer provided; depend on kmod
+
+* Fri Jan 27 2012 Kevin Fenzi <kevin@scrye.com> 1.3.8-13
+- Drop net-tools, no longer needed. Fixes bug #784803
+- Add /dev/shm/spice.* to whitelist. Fixes bug #784882
+
+* Fri Jan 06 2012 Kevin Fenzi <kevin@scrye.com> 1.3.8-12
+- Add /etc/.java to whitelist. Fixes bug #770972
+
+* Fri Nov 25 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-11
+- Add /usr/share/man/man5/.k5identity.5.gz to whitelisted hidden files. 
+
+* Wed Oct 12 2011 Jim Pirzyk <jim+rpm@pirzyk.org> - 1.3.8-10
+- Update %%files section so that some .dat files are marked %%ghost
+
+* Fri Aug 05 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-9
+- Add patch to fix ALLOWPROCDELFILE config option. fixes bug #727524
+
+* Fri Jul 08 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-8
+- Fix typo
+
+* Fri Jul 08 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-7
+- Add patch to fix out of the box warning on rkhunter script. 
+- Fixes bug #719270
+- Add etckeeper and tomboy files. Fixes bug #719265 and #719259
+
+* Tue Jun 21 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-6
+- Change ssh check back to 2 - bug #596775
+- Drop hard Requires on prelink. It will be used if present - bug #714067
+
+* Thu Apr 21 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-5
+- Add /dev/.mount to ALLOW_HIDDENDIR - bug #697599
+
+* Wed Apr 13 2011 Kevin Fenzi <kevin@scrye.com> - 1.3.8-4
+- Don't send warning emails anymore. They cause selinux issues and are not very helpful.
+- Fixes bug #660544
+
+* Wed Feb 09 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.8-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+
+* Tue Dec 07 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.8-2
+- Adjust config some - bug #596775
+
+* Fri Nov 26 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.8-1
+- Update to 1.3.8
+
+* Wed Nov 24 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-9
+- Drop /var/run as it's not used anymore - bug #656684
+
+* Wed Oct 06 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-8
+- Add patch to make rkhunter use unhide if installed - bug #636396
+
+* Sat Jun 05 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-7
+- Add ipsec.hmac exclude - bug #560594
+
+* Fri May 28 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-6
+- Add exclude for md-device-map - bug #596731
+- Supress ssh version check - bug #596775
+
+* Sat Mar 06 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-5
+- Change config to not specify XINETD_PATH - bug #560562
+
+* Sat Jan 23 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-4
+- Change email to just root instead of root@localhost - bug #553179
+- Add .k5login.5.gz to files whitelist - bug #553134
+
+* Tue Jan 05 2010 Kevin Fenzi <kevin@tummy.com> - 1.3.6-3
+- Add some more ssh hmac files to whitelist - bug #552621
+- Re-add /dev/.mdadm.map to whitelisted files - bug #539405
+
+* Tue Dec 01 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.6-2
+- Disable apps check by default - bug #543065
+
+* Sun Nov 29 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.6-1
+- Update to 1.3.6
+
+* Thu Nov 26 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-9
+- Add exception for /dev/.mdadm file - bug #539405
+
+* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.4-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
+* Fri Jul 03 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-7
+- Add exception for software raid udev file - bug #509253
+
+* Sat Jun 06 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-6
+- Add /usr/bin/.fipscheck.hmac to ok files - bug #494096
+
+* Sun Mar 08 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-5
+- Fix typo in patch file
+
+* Wed Mar 04 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-4
+- Rework spec file
+- Add check for the new hmac ssh files 
+
+* Thu Feb 26 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-3
+- Update cron job to include hostname (thanks  Manuel Wolfshant)
+
+* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.4-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
+
+* Fri Jan 02 2009 Kevin Fenzi <kevin@tummy.com> - 1.3.4-1
+- Update to 1.3.4
+- Use libdir as tmp dir - bug #456340
+
+* Sat Dec 13 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-6
+- Fix cron job sending as attachment - bug #472679
+- Fix cron job trying to send with colors - bug #475916
+
+* Wed Sep 03 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-5
+- Patch debug tmp file issue - bug #460628
+
+* Mon Jun 16 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-4
+- Fix cron script to only mail on warn/error - bug #450703
+- Fix conditional to account for fc10 rsyslog
+
+* Mon Apr 28 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-3
+- Change cron to run after prelink - bug #438622
+
+* Wed Mar 26 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-2
+- Move things to more standard locations for selinux - bug #438184
+- Add exception for pulseaudio file - bug #438622
+
+* Thu Feb 28 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.2-1
+- Update to 1.3.2
+- Fix cron script
+
+* Thu Feb 28 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.0-2
+- Use /etc/redhat-release for EPEL and /etc/fedora release for Fedora.
+- Add conditionals to support EPEL
+- Fix man page warning. 
+
+* Sun Feb 03 2008 Kevin Fenzi <kevin@tummy.com> - 1.3.0-1
+- Revive package, clean up spec
+- Update to 1.3.0
+
+* Sat Mar 18 2006 Greg Houlette <tamaster@pobox.com> - 1.2.8-3
+- Made an RPM transparent change to move the sha1 canary check
+  file out of CVS and into the external lookaside cache (whose
+  filename changes with every new package release anyway...)
+
+* Fri Mar 17 2006 Greg Houlette <tamaster@pobox.com> - 1.2.8-2
+- Fixed architectural dependency during package creation eliminating
+  use of _libdir configure macro (x86_64 /usr/lib64 mis-targeting)
+
+* Tue Mar 7 2006 Greg Houlette <tamaster@pobox.com> - 1.2.8-1
+- New package version release
+- reworked the .spec file to support optional dist tag
+- Updated the application check default patchfile (chunk failure)
+- Changed to SHA1 for optional message digest (canary check)
+- Added a couple of suggested skip entries to rkhunter.conf
+
+* Sat Jun 11 2005 Greg Houlette <tamaster@pobox.com> - 1.2.7-1
+- Added signature auto-updating to CRON scan (new script)
+- Removed BOOTSCAN pending rewrite to full SysV Init scan in background
+- Added the --append-log command line option
+- Added Date Stamping to output
+- Fixed bug in /etc/group missing report
+- New package version release
+
+* Sun Jan 2 2005 Greg Houlette <tamaster@tekarmory.com> - 0:1.1.9-1
+- New package version release
+- Added the --run-application-check command line option
+  to listing in command help
+- Replaced 'Here' Doc editing of rkhunter.conf file
+  with in-place Perl edit
+- tweaked rpmbuild -bb Autoclean
+
+* Fri Oct 15 2004 Greg Houlette - 0:1.1.8-0.fdr.1 (revisited)
+- Removed redundant buildrequires /bin/sh, coreutils and perl
+- Revise postun scriptlet
+- Added /usr/share/doc/rkhunter-1.1.8/ to files list
+
+* Mon Oct 11 2004 Greg Houlette - 0:1.1.8-0.fdr.1
+- Changed Release Tag to 0.fdr.1 (testing) for QA
+- Removed wget from dependencies
+- Hid (temporarily) the --skip-application-check command
+  line option from being listed in help
+- Fixed the spec files list, again!
+
+* Fri Oct 8 2004 Greg Houlette - 0:1.1.8-0.fdr.0.2.beta2
+- Unified and disabled the md5 canary check in prep
+  (check is now optional) removing the sha1 cross-check
+- Fixed the spec files list, adding the /var/rkhunter
+  directory and the /usr/bin/rkhunter executable
+- Fixed missing dependencies (rkh uses runtime checks)
+- Disabled "auto-clean" for rpmbuild -bb
+- Changed Application version scan default to
+  disabled awaiting backport fix in upstream sources
+- Fixed shared_man_search.patch, configuration files
+  verify and added postun(install) cleanup
+
+* Fri Oct 1 2004 Greg Houlette - 0:1.1.8-0.fdr.0.1.beta1
+- More cosmetic patchwork
+- Changed Release Tag to beta1 (pre-release) for QA submit
+
+* Tue Sep 28 2004 Greg Houlette - 0:1.1.8-0.fdr.1
+- Removed hidden_search.patch (1.1.7) after it was
+  merged into upstream source by Michael Boelen
+- Removed .spec file from md5 and sha1 file checks
+  (it must be modifiable by Fedora QA release build)
+- Added BOOTSCAN description file to documentation
+- Restructured dynamic file creation ('Here' Docs)
+  moving them to the "prep" stage so that *_ALL_*
+  files are available prior to the "build" stage
+  (for inspection purposes)
+- Added a /etc/sysconfig/rkhunter parameters file
+
+* Sun Aug 29 2004 Greg Houlette - 0:1.1.7-0.fdr.1
+- Cosmetic patchwork
+
+* Sat Aug 21 2004 Greg Houlette - 0:1.1.6-0.fdr.1
+- Moderate reworking of .spec file for packaging standards
+- Added md5 and sha1 file checks to prep procedure for source .rpm
+- Included an optional rc.local replacement for scan on boot (with full logging)
+
+* Tue Aug 10 2004 Michael Boelen - 1.1.5
+- Added update script
+- Extended description
+
+* Sun Aug 08 2004 Greg Houlette - 1.1.5
+- Changed the install procedure eliminating the specification of
+  destination filenames (only needed if you are renaming during install)
+- Changed the permissions for documentation files (root only overkill)
+- Added the installation of the rkhunter Man Page
+- Added the installation of the programs_{bad, good}.dat database files
+- Added the installation of the LICENSE documentation file
+- Added the chmod for root only to the /var/rkhunter/db directory
+
+* Sun May 23 2004 Craig Orsinger (cjo) <cjorsinger@earthlink.net>
+- version 1.1.0-1.cjo
+- changed installation in accordance with new rootkit installation
+  procedure
+- changed installation root to conform to LSB. Use standard macros.
+- added recursive remove of old build root as prep for install phase
+
+* Wed Apr 28 2004 Doncho N. Gunchev - 1.0.9-0.mr700
+- dropped Requires: perl - rkhunter works without it 
+- dropped the bash alignpatch (check the source or contact me)
+- various file mode fixes (.../tmp/, *.db)
+- optimized the %%files section - any new files in the
+  current dirs will be fine - just %%{__install} them.
+
+* Mon Apr 26 2004 Michael Boelen - 1.0.8-0
+- Fixed missing md5blacklist.dat
+
+* Mon Apr 19 2004 Doncho N. Gunchev - 1.0.6-1.mr700
+- added missing /usr/local/rkhunter/db/md5blacklist.dat
+- patched to align results in --cronjob, I think rpm based
+  distros have symlink /bin/sh -> /bin/bash
+- added --with/--without alignpatch for conditional builds
+  (in case previous patch breaks something)
+
+* Sat Apr 03 2004 Michael Boelen / Joe Klemmer - 1.0.6-0
+- Update to 1.0.6
+
+* Mon Mar 29 2004 Doncho N. Gunchev - 1.0.0-0
+- initial .spec file

rkhunter.sysconfig

@@ -0,0 +1,10 @@
+# System configuration file for Rootkit Hunter which
+# stores RPM system specifics for cron run, etc.
+#
+#    MAILTO= <email address to send scan report>
+# DIAG_SCAN= no  - perform  normal  report scan
+#            yes - perform detailed report scan
+#                  (includes application check)
+
+MAILTO=root@localhost
+DIAG_SCAN=no

sources

@@ -0,0 +1 @@
+SHA512 (rkhunter-1.4.6.tar.gz) = c51a21b6b66ed1f73a19d8ce04eaba35999eefcb666acc824989c3bf53ac56d24a33ac4fec290be942e33fe24674406b371eafff73f7e697b9e03ec031b37216