On Sat, 18 May 2024 at 08:39, Shai Berger <s...@platonix.com> wrote: > This morning, when chkrootkit made its daily run, I had > in /tmp a file named: 'חברת חשמל לישראל בע"מ - חשבון דו חודשי.pdf' > (the single quote marks on the edges are not part of the name, but > the double quote mark in the middle is) > > This caused this output from the script: > > """ > Searching for suspect PHP files... /usr/bin/head: > cannot open '/tmp/חברת חשמל לישראל בעמ' for reading: No such file or directory > /usr/bin/head: cannot open 'חשבון' for reading: No such file or directory > /usr/bin/head: cannot open 'דו' for reading: No such file or directory > /usr/bin/head: cannot open 'חודשי.pdf 2>/dev/null | /usr/bin/grep -q ^#!.*php > && echo /tmp/חברת' for reading: No such file or directory > /usr/bin/head: cannot open 'חשמל' for reading: No such file or directory > /usr/bin/head: cannot open 'לישראל' for reading: No such file or directory > /usr/bin/head: cannot open 'בעמ - חשבון דו חודשי.pdf' for reading: No such > file or directory > WARNING
Thanks, yes this is probably also bug in upstream as well, but there are debian-specific patches that make this worse. Will fix. Patches also welcome - it's patch number 16 in debian/patches that has the PHP check.
