Yes I know, but I was searching for something like ALLOWPROCDELFILE=/usr/bin/gnome-keyring-daemon.* but don't work :(
ND On Sáb, 2008-10-04 at 20:37 +0100, John Horne wrote: > On Fri, 2008-09-26 at 10:33 +0100, Nuno Dias wrote: > > Hi, > > > > I'm getting this warnings in daily mail from rkhunter > > > > [10:06:50] Warning: The following processes are using deleted files: > > [10:06:50] > > Process: /usr/bin/gnome-keyring-daemon.#prelink#.IBG0ni PID: 2464 > > File: /usr/bin/gnome-keyring-daemon.#prelink#.IBG0ni > > > > How can I whitelist this process because > > ALLOWPROCDELFILE=/usr/bin/gnome-keyring-daemon do not work :( > > > I suspect you will find that these will 'disappear' on their own. It is > part of the prelink process, and it seems that some commands are renamed > during the process of prelinking (probably because they are in use). If > the process (/usr/bin/gnome-keyring-daemon in your case) is restarted > (don't ask me how), or the system restarted, then the old files should > be deleted (probably when prelinking occurs again). > > Sorry, it is a bit vague, but I have had the same problem once or twice > myself. I have not had time though to thoroughly investigate what is > happening, and when I do look the old commands have gone. > > If you really want to whitelist them you could try: > > ALLOWPROCDELFILE=/usr/bin/gnome-keyring-daemon.#prelink#.IBG0ni > > > > John. > -- Nuno Dias <[EMAIL PROTECTED]> LIP ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users
