Add patch to fix false positive for libkeyutils

Allow KRA vault log files. Fixes bug #1541472
ipc_shared_mem warning fixed upstream. Fixes bug #1524456

.gitignore

@@ -2,3 +2,5 @@ rkhunter-1.3.6.tar.gz
 /rkhunter-1.3.8.tar.gz
 /rkhunter-1.4.0.tar.gz
 /rkhunter-1.4.2.tar.gz
+/rkhunter-1.4.4.tar.gz
+/rkhunter-1.4.6.tar.gz

01-rkhunter

@@ -19,7 +19,7 @@ if [ ! -e /var/lock/subsys/rkhunter ]; then
   fi
 
   # If a diagnostic mode scan was requested, setup the parameters
-  if [ "$DIAG_SCAN" == "yes" ]; then
+  if [ "$DIAG_SCAN" = "yes" ]; then
     RKHUNTER_FLAGS="--checkall --skip-keypress --nocolors --quiet --appendlog --display-logfile"
   else
     RKHUNTER_FLAGS="--cronjob --nocolors --report-warnings-only"

rkhunter-1.4.6-drop-libkeyutils-check.patch

@@ -0,0 +1,43 @@
+diff --color -Nur rkhunter-1.4.6.orig/files/rkhunter rkhunter-1.4.6/files/rkhunter
+--- rkhunter-1.4.6.orig/files/rkhunter	2018-02-24 15:08:27.000000000 -0800
++++ rkhunter-1.4.6/files/rkhunter	2021-01-15 12:47:54.399665856 -0800
+@@ -8370,9 +8370,7 @@
+ 		     /lib/libsbr.so
+ 		     /lib64/libsbr.so
+ 		     /lib/libslr.so
+-		     /lib64/libslr.so
+-		     /lib/tls/libkeyutils.so.1
+-		     /lib64/tls/libkeyutils.so.1"
++		     /lib64/libslr.so"
+ 	EBURY_DIRS=
+ 	EBURY_KSYMS=
+ 
+@@ -9762,10 +9760,6 @@
+ 		  file:/usr/share/sshd.sync:Trojaned SSH daemon
+ 		  file:/bin/zcut:Trojaned SSH daemon
+ 		  file:/usr/bin/zmuie:Trojaned SSH daemon
+-		  file:/lib/libkeyutils.so.1.9:Sniffer component
+-		  file:/lib64/libkeyutils.so.1.9:Sniffer component
+-		  file:/usr/lib/libkeyutils.so.1.9:Sniffer component
+-		  file:/usr/lib64/libkeyutils.so.1.9:Sniffer component
+ 		  file:/IptabLes:malware component
+ 		  file:/.IptabLex:malware component
+ 		  file:/boot/.IptabLex:malware component
+@@ -9956,7 +9950,6 @@
+ 			 ssh-scan:Port scanner
+ 			 atac:Port scanner component
+ 			 \[pdflush\]:IRC bot
+-			 libkeyutils.so.1.9:Spam tool component
+ 			 .IptabLex:malware component
+ 			 .IptabLes:malware component
+ 			 .flush:malware component
+diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb
+--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils1.ldb	2017-11-29 08:14:02.000000000 -0800
++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils1.ldb	1969-12-31 16:00:00.000000000 -0800
+@@ -1 +0,0 @@
+-RKH_libkeyutils.so.1.9-v1;Target:0;(((0&1&2)|(3&4&5))&((6&7&8)|(9&10)));58636174;58766572;58626e64;73686d6174;73686d6474;73686d676574;62696e64;636f6e6e656374;736f636b6574;737973636f6e66;746d7066696c65
+diff --color -Nur rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb
+--- rkhunter-1.4.6.orig/files/signatures/RKH_libkeyutils.ldb	2017-11-29 08:14:02.000000000 -0800
++++ rkhunter-1.4.6/files/signatures/RKH_libkeyutils.ldb	1969-12-31 16:00:00.000000000 -0800
+@@ -1 +0,0 @@
+-RKH_libkeyutils.1.9.so;Target:0;(0&1&2&3&4&5&6&7&8&9&10&11&12&13&14&15&16);737973636f6e66;746d7066696c65;77616974706964;736f636b6574;636f6e6e656374;73686d6174;73686d6474;73686d676574;73656d676574;73656d74696d65646f70;736c656570;737072696e7466;7372616e64;7374646f7574;737472636174;737472637079;5f5f737472647570

rkhunter-1.4.6-epel7.patch

@@ -1,7 +1,13 @@
-diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.conf
---- rkhunter-1.4.2.orig/files/rkhunter.conf	2014-02-23 19:38:01.000000000 -0700
-+++ rkhunter-1.4.2/files/rkhunter.conf	2014-03-05 17:23:47.171809385 -0700
-@@ -155,6 +155,7 @@
+diff -Nur rkhunter-1.4.6.orig/files/rkhunter.conf rkhunter-1.4.6/files/rkhunter.conf
+--- rkhunter-1.4.6.orig/files/rkhunter.conf	2018-02-19 15:49:06.000000000 -0800
++++ rkhunter-1.4.6/files/rkhunter.conf	2020-05-16 14:20:16.767707769 -0700
+@@ -1,4 +1,4 @@
+-#
++##
+ # This is the main configuration file for Rootkit Hunter.
+ #
+ # You can modify this file directly, or you can create a local configuration
+@@ -158,6 +158,7 @@
  # default directory beneath the installation directory.
  #
  #TMPDIR=/var/lib/rkhunter/tmp
@@ -9,16 +15,15 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # This option specifies the database directory to use.
-@@ -163,7 +164,7 @@
- # subsequently commented out or removed, then the program will assume a
+@@ -167,6 +168,7 @@
  # default directory beneath the installation directory.
  #
--#DBDIR=/var/lib/rkhunter/db
+ #DBDIR=/var/lib/rkhunter/db
 +DBDIR=/var/lib/rkhunter/db
  
  #
  # This option specifies the script directory to use.
-@@ -172,6 +173,7 @@
+@@ -175,6 +177,7 @@
  # subsequently commented out or removed, then the program will not run.
  #
  #SCRIPTDIR=/usr/local/lib/rkhunter/scripts
@@ -26,7 +31,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # This option can be used to modify the command directory list used by rkhunter
-@@ -228,7 +230,7 @@
+@@ -231,7 +234,7 @@
  #
  # The default value is '/var/log/rkhunter.log'.
  #
@@ -35,7 +40,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Set this option to '1' if the log file is to be appended to whenever rkhunter
-@@ -238,6 +240,7 @@
+@@ -241,6 +244,7 @@
  # The default value is '0'.
  #
  #APPEND_LOG=0
@@ -43,7 +48,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Set the following option to '1' if the log file is to be copied when rkhunter
-@@ -304,6 +307,7 @@
+@@ -307,6 +311,7 @@
  # The default value is 'no'.
  #
  #ALLOW_SSH_ROOT_USER=no
@@ -51,7 +56,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Set this option to '1' to allow the use of the SSH-1 protocol, but note
-@@ -318,6 +322,7 @@
+@@ -321,6 +326,7 @@
  # The default value is '0'.
  #
  #ALLOW_SSH_PROT_V1=0
@@ -59,17 +64,17 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # This setting tells rkhunter the directory containing the SSH configuration
-@@ -350,7 +355,8 @@
+@@ -353,7 +359,8 @@
  # program defaults.
  #
  ENABLE_TESTS=ALL
--DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps
-+#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps
-+DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps
+-DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps
++#DISABLE_TESTS=suspscan hidden_ports hidden_procs deleted_files packet_cap_apps apps
++DISABLE_TESTS=suspscan hidden_ports deleted_files packet_cap_apps apps ipc_shared_mem
  
  #
  # The HASH_CMD option can be used to specify the command to use for the file
-@@ -422,6 +428,7 @@
+@@ -435,6 +442,7 @@
  # Also see the PKGMGR_NO_VRFY and USE_SUNSUM options.
  #
  #PKGMGR=NONE
@@ -77,17 +82,22 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # It is possible that a file, which is part of a package, may have been
-@@ -545,6 +552,9 @@
+@@ -558,6 +566,14 @@
  # The default value is the null string.
  #
  #EXISTWHITELIST=""
 +EXISTWHITELIST=/bin/ad
 +# FreeIPA Certificate Authority
 +EXISTWHITELIST=/var/log/pki-ca/system
++# FreeIPA Certificate Authority
++EXISTWHITELIST=/var/log/pki/pki-tomcat/ca/system
++# Some non default installed files we check
++EXISTWHITELIST=/usr/bin/GET
++EXISTWHITELIST=/usr/bin/whatis
  
  #
  # Whitelist various attributes of the specified file. The attributes are those
-@@ -575,6 +585,12 @@
+@@ -588,6 +604,12 @@
  # The default value is the null string.
  #
  #SCRIPTWHITELIST=/usr/bin/groups
@@ -100,7 +110,7 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Allow the specified file to have the immutable attribute set.
-@@ -605,6 +621,19 @@
+@@ -630,6 +652,19 @@
  #ALLOWHIDDENDIR=/dev/.udev
  #ALLOWHIDDENDIR=/dev/.udevdb
  #ALLOWHIDDENDIR=/dev/.mdadm
@@ -120,10 +130,12 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
  
  #
  # Allow the specified hidden file to be whitelisted.
-@@ -620,6 +649,30 @@
+@@ -644,7 +679,33 @@
+ #ALLOWHIDDENFILE=/usr/lib/.libfipscheck.so.1.1.0.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha1hmac.hmac
  #ALLOWHIDDENFILE=/usr/lib/hmaccalc/sha256hmac.hmac
- #ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
+-#ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
++ALLOWHIDDENFILE=/usr/sbin/.sshd.hmac
 +ALLOWHIDDENFILE="/usr/share/man/man1/..1.gz"
 +ALLOWHIDDENFILE=/lib*/.libcrypto.so.*.hmac
 +ALLOWHIDDENFILE=/lib*/.libssl.so.*.hmac
@@ -148,13 +160,26 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
 +ALLOWHIDDENFILE=/etc/.etckeeper
 +ALLOWHIDDENFILE=/etc/.gitignore
 +ALLOWHIDDENFILE=/etc/.bzrignore
++# systemd
++ALLOWHIDDENFILE=/etc/.updated
  
  #
  # Allow the specified process to use deleted files. The process name may be
-@@ -681,6 +734,16 @@
+@@ -714,6 +775,35 @@
  #
  #ALLOWDEVFILE=/dev/shm/pulse-shm-*
  #ALLOWDEVFILE=/dev/shm/sem.ADBE_*
++# Allow PCS/Pacemaker/Corosync
++ALLOWDEVFILE=/dev/shm/qb-attrd-*
++ALLOWDEVFILE=/dev/shm/qb-cfg-*
++ALLOWDEVFILE=/dev/shm/qb-cib_rw-*
++ALLOWDEVFILE=/dev/shm/qb-cib_shm-*
++ALLOWDEVFILE=/dev/shm/qb-corosync-*
++ALLOWDEVFILE=/dev/shm/qb-cpg-*
++ALLOWDEVFILE=/dev/shm/qb-lrmd-*
++ALLOWDEVFILE=/dev/shm/qb-pengine-*
++ALLOWDEVFILE=/dev/shm/qb-quorum-*
++ALLOWDEVFILE=/dev/shm/qb-stonith-*
 +ALLOWDEVFILE=/dev/shm/pulse-shm-*
 +ALLOWDEVFILE=/dev/md/md-device-map
 +# tomboy creates this one
@@ -165,22 +190,35 @@ diff -Nur rkhunter-1.4.2.orig/files/rkhunter.conf rkhunter-1.4.2/files/rkhunter.
 +ALLOWDEVFILE="/dev/shm/spice.*"
 +# created by mdadm
 +ALLOWDEVFILE="/dev/md/autorebuild.pid"
++# 389 Directory Server
++ALLOWDEVFILE=/dev/shm/sem.slapd-*.stats
++# squid proxy
++ALLOWDEVFILE=/dev/shm/squid-cf*
++# squid ssl cache
++ALLOWDEVFILE=/dev/shm/squid-ssl_session_cache.shm
++# Allow podman
++ALLOWDEVFILE=/dev/shm/libpod*lock*
  
  #
- # This option is used to indicate if the Phalanx2 test is to perform a basic
-@@ -1004,6 +1067,9 @@
+ # Allow the specified process pathnames to use shared memory segments.
+@@ -1090,6 +1180,14 @@
  #
  #RTKT_DIR_WHITELIST=""
  #RTKT_FILE_WHITELIST=""
 +RTKT_FILE_WHITELIST=/bin/ad
 +# FreeIPA Certificate Authority
 +RTKT_FILE_WHITELIST=/var/log/pki-ca/system
++# FreeIPA Certificate Authority
++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/ca/system
++# FreeIPA with KRA (Password Vault)
++EXISTWHITELIST=/var/log/pki/pki-tomcat/kra/system
++RTKT_FILE_WHITELIST=/var/log/pki/pki-tomcat/kra/system
  
  #
  # The following option can be used to whitelist shared library files that would
-@@ -1222,3 +1288,5 @@
+@@ -1329,3 +1427,5 @@
+ # The default value is '0'.
  #
- #EMPTY_LOGFILES=""
- #MISSING_LOGFILES=""
+ #GLOBSTAR=0
 +
 +INSTALLDIR="/usr"

rkhunter.spec

@@ -2,8 +2,8 @@
 %{!?_pkgdocdir: %global _pkgdocdir %{_docdir}/%{name}-%{version}}
 
 Name:           rkhunter
-Version:        1.4.2
-Release:        1%{?dist}
+Version:        1.4.6
+Release:        3%{?dist}
 Summary:        A host-based tool to scan for rootkits, backdoors and local exploits
 
 Group:          Applications/System
@@ -12,7 +12,8 @@ URL:            http://rkhunter.sourceforge.net/
 Source0:        http://downloads.sourceforge.net/rkhunter/rkhunter-%{version}.tar.gz
 Source2:        01-rkhunter
 Source3:        rkhunter.sysconfig
-Patch0:         rkhunter-1.4.2-fedoraconfig.patch
+Patch0:         rkhunter-1.4.6-epel7.patch
+Patch1:         rkhunter-1.4.6-drop-libkeyutils-check.patch
 BuildArch:      noarch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
@@ -28,9 +29,7 @@ and other unwanted tools.
 
 %prep
 
-%setup -q
-
-%patch0 -p1
+%autosetup -p1
 
 %{__cat} <<'EOF' >%{name}.logrotate
 %{_localstatedir}/log/%{name}/%{name}.log {
@@ -51,6 +50,7 @@ EOF
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_pkgdocdir}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8
+%{__mkdir} -m700 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/log/%{name}
 %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/lib/%{name}/db/i18n
@@ -99,6 +99,51 @@ EOF
 %{_mandir}/man8/*
 
 %changelog
+* Tue May 04 2021 Kevin Fenzi <kevin@scrye.com> - 1.4.6-3
+- Add patch to fix false positive for libkeyutils
+
+* Sat May 16 2020 Kevin Fenzi <kevin@scrye.com> - 1.4.6-2
+- Add allow for podman's /dev/shm files (fixes bug #1828698 )
+
+* Sun Feb 25 2018 Kevin Fenzi <kevin@scrye.com> - 1.4.6-1
+- Upgrade to 1.4.6. Fixes bug #1524456
+- Allow KRA vault log files. Fixes bug #1541472
+- ipc_shared_mem warning fixed upstream. Fixes bug #1524456
+
+* Sat Aug 12 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-3
+- Disable ipc_shared_mem test for now due to false positives. Bug #1472299
+
+* Mon Jul 03 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-2
+- Correct some rebasing errors on config.
+
+* Fri Jun 30 2017 Kevin Fenzi <kevin@scrye.com> - 1.4.4-1
+- Update to 1.4.4. Fixes bug #1466318
+- Fix for logger and spaces. Fixes bug #1284403
+
+* Wed Jan 25 2017 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-8
+- Add /dev/shm/qb* files to whitelist. Fixes bug #1403602
+- Add /dev/shm/squid-ssl_session_cache.shm to whitelist. Fixes bug #1411130
+
+* Tue Jan 05 2016 Mukundan Ragavan <nonamedotc@fedoraproject.org> - 1.4.2-7
+- Fix ssh config value in patch
+
+* Thu Dec 31 2015 Mukundan Ragavan <nonamedotc@gmail.com> - 1.4.2-6
+- Allow /etc/.updated on EL7
+- Fixes bug#1291629
+
+* Mon Oct 27 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-5
+- Set /var/lib/rkhunter to be mode 700. fixes bug #1154428
+
+* Fri Sep 26 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-4
+- Fix cron script to work with non bash shells. Fixes bug #1146717
+
+* Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.4.2-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Sun Apr 06 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-2
+- Add patch to fix ipcs command in non en locales
+- Add config to fix freeipa installs. Fixes bug #994567
+
 * Fri Mar 14 2014 Kevin Fenzi <kevin@scrye.com> 1.4.2-1
 - Update to 1.4.2
 
@@ -289,7 +334,7 @@ EOF
 - Changed to SHA1 for optional message digest (canary check)
 - Added a couple of suggested skip entries to rkhunter.conf
 
-* Mon Jun 11 2005 Greg Houlette <tamaster@pobox.com> - 1.2.7-1
+* Sat Jun 11 2005 Greg Houlette <tamaster@pobox.com> - 1.2.7-1
 - Added signature auto-updating to CRON scan (new script)
 - Removed BOOTSCAN pending rewrite to full SysV Init scan in background
 - Added the --append-log command line option

sources

@@ -1 +1 @@
-85ad366b7f3999eb2a9371e39a1a4df7  rkhunter-1.4.2.tar.gz
+SHA512 (rkhunter-1.4.6.tar.gz) = c51a21b6b66ed1f73a19d8ce04eaba35999eefcb666acc824989c3bf53ac56d24a33ac4fec290be942e33fe24674406b371eafff73f7e697b9e03ec031b37216