On Fri, 2008-09-26 at 10:33 +0100, Nuno Dias wrote: > Hi, > > I'm getting this warnings in daily mail from rkhunter > > [10:06:50] Warning: The following processes are using deleted files: > [10:06:50] > Process: /usr/bin/gnome-keyring-daemon.#prelink#.IBG0ni PID: 2464 > File: /usr/bin/gnome-keyring-daemon.#prelink#.IBG0ni > > How can I whitelist this process because > ALLOWPROCDELFILE=/usr/bin/gnome-keyring-daemon do not work :( > I suspect you will find that these will 'disappear' on their own. It is part of the prelink process, and it seems that some commands are renamed during the process of prelinking (probably because they are in use). If the process (/usr/bin/gnome-keyring-daemon in your case) is restarted (don't ask me how), or the system restarted, then the old files should be deleted (probably when prelinking occurs again).
Sorry, it is a bit vague, but I have had the same problem once or twice myself. I have not had time though to thoroughly investigate what is happening, and when I do look the old commands have gone. If you really want to whitelist them you could try: ALLOWPROCDELFILE=/usr/bin/gnome-keyring-daemon.#prelink#.IBG0ni John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 587287 E-mail: [EMAIL PROTECTED] Fax: +44 (0)1752 587001 ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users
