A while back another user had a problem where running rkhunter -c caused it to spit out jillions of lines of the following:
/usr/local/bin/rkhunter[5286]: [: -n: unexpected operator/operand My good friend and coworker and I traced the error down and found a fix a while back. It's caused by a stupidity in the way that ksh interprets the quotes in the [ ] test operator. In the script: if [ "$1" = "-n" -o "$1" = "-e" ]; then ...confuses test, which causes the error messages because test is trying to interpret the -n as a unary operator, instead of a string. I think changing the [ expression ] to [[ expression ]] might fix this, since it would cause ksh to use its built-in test function instead. But, that might not work in some other environments. We opted instead to fix it by placing a single letter in front of the operands: if [ "a$1" = "a-n" -o "a$1" = "a-e" ]; then ...which is horrible, and ugly, and perverse, and apparently also a fairly practical solution which we don't think will confuse any shells. The diff (for 1.2.9) is below, if you like. Thanks, - R. # cat /root/rkhunter.diff 480c480 < if [ "$1" = "-n" -o "$1" = "-e" ]; then --- > if [ "a$1" = "a-n" -o "a$1" = "a-e" ]; then 487c487 < [ "$1" = "-n" ] && echo -n "$2" || echo $ECHOOPT "$2" --- > [ "a$1" = "a-n" ] && echo -n "$2" || echo > $ECHOOPT "$2" 492c492 < [ "$1" = "-n" ] && PREVIOUSTEXT=`echo "$2" | sed 's/^ \+//'` --- > [ "a$1" = "a-n" ] && PREVIOUSTEXT=`echo "$2" | sed 's/^ > \+//'` ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users
