Boyd Lynn Gerber wrote:
Did you intend to reply only to me? I got this off list.
> On Fri, 5 Dec 2008, Mike McCarty wrote:
>> Boyd Lynn Gerber wrote:
>>>
>>> I am running openSUSE 11.0 with the same version of rkhunter.
>>>
>>>> I am using rkhunter version 1.3.2.
>>>
>>> I added to my /etc/rkhunter.conf file the following.
>>>
>>> ALLOWDEVFILE=/dev/shm/sysconfig/ifup-lo
>>> ALLOWDEVFILE=/dev/shm/sysconfig/if-lo
>>> ALLOWDEVFILE=/dev/shm/sysconfig/network
>>
>> [etc.]
>>
>> That doesn't explain why you need to do so.
>
> I have rkhunter putting temp files in /dev/shm
>
> On openSUSE sysconfig uses /dev/shm/sysconfig/ YaST2 runs sysconfig
> after it installs rpm packages to finish configurations. On the
> openSUSE security list we discussed this with SUSE's security people and
> they are the ones that said this had to be done. Every time one runs
> yast2 or sysconfig it can and often does create/change files in
> /dev/shm. This is normal on openSUSE 10.3, 11.0, 11.1 and will also be
> needed for 11.2. It is also needed for SLES and SLED.
That's interesting. Well, perhaps you do need to relax rkhunter
for those files. I'm not one who likes to do that sort of thing,
but sometimes it's just what you've got to do. At least, you can
relax the checking only for those files which you know are
necessary.
Mike
--
p="p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);}
Oppose globalization and One World Governments like the UN.
This message made from 100% recycled bits.
You have found the bank of Larn.
I speak only for myself, and I am unanimous in that!
------------------------------------------------------------------------------
SF.Net email is Sponsored by MIX09, March 18-20, 2009 in Las Vegas, Nevada.
The future of the web can't happen without you. Join us at MIX09 to help
pave the way to the Next Web now. Learn more and register at
http://ad.doubleclick.net/clk;208669438;13503038;i?http://2009.visitmix.com/
_______________________________________________
Rkhunter-users mailing list
Rkhunter-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/rkhunter-users
