106 lines
4.2 KiB
RPMSpec
106 lines
4.2 KiB
RPMSpec
Name: unhide
|
|
Version: 20130526
|
|
Release: 3%{?dist}
|
|
Summary: Tool to find hidden processes and TCP/UDP ports from rootkits
|
|
License: GPLv3
|
|
URL: http://www.unhide-forensics.info/
|
|
Source0: http://downloads.sourceforge.net/project/unhide/unhide/unhide-%{version}.tgz
|
|
|
|
%description
|
|
Unhide is a forensic tool to find processes and TCP/UDP ports hidden by
|
|
rootkits, Linux kernel modules or by other techniques. It includes two
|
|
utilities: unhide and unhide-tcp.
|
|
|
|
Unhide detects hidden processes using three techniques:
|
|
|
|
- comparing the output of /proc and /bin/ps
|
|
- comparing the information gathered from /bin/ps with the one gathered
|
|
from system calls (syscall scanning)
|
|
- full scan of the process ID space (PIDs bruteforcing)
|
|
|
|
unhide-tcp identifies TCP/UDP ports that are listening but are not listed
|
|
in /bin/netstat through brute forcing of all TCP/UDP ports available.
|
|
|
|
%prep
|
|
%setup -q
|
|
chmod -x sanity*.sh
|
|
|
|
%build
|
|
%{__cc} %{optflags} -lpthread unhide-linux*.c unhide-output.c -o unhide %{?__global_ldflags}
|
|
%{__cc} %{optflags} unhide-tcp.c unhide-tcp-fast.c unhide-output.c -o unhide-tcp %{?__global_ldflags}
|
|
%{__cc} %{optflags} unhide_rb.c -o unhide_rb %{?__global_ldflags}
|
|
|
|
%install
|
|
mkdir -p %{buildroot}%{_sbindir}/
|
|
mkdir -p %{buildroot}%{_mandir}/man8/
|
|
mkdir -p %{buildroot}%{_mandir}/es/man8/
|
|
mkdir -p %{buildroot}%{_mandir}/fr/man8/
|
|
install -pm0755 unhide %{buildroot}%{_sbindir}/
|
|
install -pm0755 unhide-tcp %{buildroot}%{_sbindir}/
|
|
install -pm0755 unhide_rb %{buildroot}%{_sbindir}/
|
|
install -pm0644 man/unhide.8 %{buildroot}%{_mandir}/man8/
|
|
install -pm0644 man/unhide-tcp.8 %{buildroot}%{_mandir}/man8/
|
|
install -pm0644 man/es/unhide.8 %{buildroot}%{_mandir}/es/man8
|
|
install -pm0644 man/es/unhide-tcp.8 %{buildroot}%{_mandir}/es/man8/
|
|
install -pm0644 man/fr/unhide.8 %{buildroot}%{_mandir}/fr/man8/
|
|
install -pm0644 man/fr/unhide-tcp.8 %{buildroot}%{_mandir}/fr/man8/
|
|
|
|
%files
|
|
%doc COPYING changelog README.txt NEWS sanity.sh sanity-tcp.sh
|
|
%{_mandir}/man8/unhide*.8*
|
|
%{_mandir}/es/man8/unhide*.8*
|
|
%{_mandir}/fr/man8/unhide*.8*
|
|
%{_sbindir}/unhide
|
|
%{_sbindir}/unhide-tcp
|
|
%{_sbindir}/unhide_rb
|
|
|
|
%changelog
|
|
* Mon Aug 18 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20130526-3
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
|
|
|
|
* Sun Jun 08 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 20130526-2
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
|
|
|
|
* Thu Jan 09 2014 Christopher Meng <rpm@cicku.me> - 20130526-1
|
|
- Update to 20130526
|
|
- Add multilingual manpages.
|
|
- SPEC cleanup, build with RELRO.
|
|
|
|
* Fri Jul 26 2013 Parag <paragn AT fedoraproject DOT org> - 1.0-10.20121229
|
|
- Update to new version
|
|
|
|
* Fri Feb 15 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0-9.20100201
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
|
|
|
|
* Sun Jul 22 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0-8.20100201
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
|
|
|
|
* Sat Jan 14 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0-7.20100201
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
|
|
|
|
* Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0-6.20100201
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
|
|
|
|
* Mon May 03 2010 Rakesh Pandit <rakesh@fedoraproject.org> 1.0-5.20100201
|
|
- Updated to 20100201
|
|
|
|
* Fri Dec 04 2009 Rakesh Pandit <rakesh@fedoraproject.org> 1.0-5.20090810
|
|
- Updated to 20090810
|
|
|
|
* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0-4.20080519
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
|
|
|
|
* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.0-3.20080519
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
|
|
|
|
* Thu Jan 08 2009 Rakesh Pandit <rakesh@fedoraproject.org> 1.0-2
|
|
- clarified from upstream about license - fixed.
|
|
|
|
* Sat Dec 06 2008 Rakesh Pandit <rakesh@fedoraproject.org> 1.0-1
|
|
- Fixed %%Version and %%Release fields.
|
|
|
|
* Fri Nov 07 2008 Rakesh Pandit <rakesh@fedoraproject.org> 20080519-2
|
|
- Clear %%install, consistency of macro use
|
|
|
|
* Tue Nov 04 2008 Rakesh Pandit <rakesh@fedoraproject.org> 20080519-1
|
|
- Initial package
|