On Sun, 2014-08-03 at 15:00 +0200, Sam Ashley wrote: > Hi all, > > ALLOWPROCDELFILE="/usr/lib/firefox/firefox:/var/tmp/*:/tmp/*" > > Is that not the correct way to do it? It seems to me from the > documentation that that should be correct, yet about 3 times/week > rkhunter reports that process using deleted files in one of those > directories. > As far as I can tell the option looks fine. We would need to look at the rkhunter log file to see what is going on. Probably best to email it to me rather than the list.
John. -- ---------------------------------------------------- John Horne Tel: +44 (0)1752 587287 Plymouth University, UK ------------------------------------------------------------------------------ Want fast and easy access to all the code in your enterprise? Index and search up to 200,000 lines of code with a free copy of Black Duck Code Sight - the same software that powers the world's largest code search on Ohloh, the Black Duck Open Hub! Try it now. http://p.sf.net/sfu/bds _______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users
