Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1223671
| From | Richard Lewis <richard.lewis.debian@googlemail.com> |
|---|---|
| Newsgroups | linux.debian.bugs.dist |
| Subject | Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles |
| Date | 2024-12-12 00:50 +0100 |
| Message-ID | <JSECR-gdNH-3@gated-at.bofh.it> (permalink) |
| References | (2 earlier) <JS4zo-fM6Z-3@gated-at.bofh.it> <JS8jD-fOJ7-5@gated-at.bofh.it> <JSxi2-g8W4-5@gated-at.bofh.it> <JRLn3-fpm2-5@gated-at.bofh.it> <JSxi2-g8W4-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Wed, 11 Dec 2024 at 15:53, Julian Gilbey <jdg@debian.org> wrote: > > On Tue, Dec 10, 2024 at 01:10:16PM +0000, Richard Lewis wrote: > > On Tue, 10 Dec 2024, 09:10 Julian Gilbey, <jdg@debian.org> wrote: > > > > On Mon, Dec 09, 2024 at 10:45:40PM +0000, Richard Lewis wrote: > > > On Mon, 9 Dec 2024, 12:42 Julian Gilbey, <jdg@debian.org> wrote: > > > chkrootkit updates the > > > access times of all the files in /tmp > > > > > it to that time afterwards (presumably using utimes(2) or similar). > > > > Something like this should work in a shell script: > > > > origtime=$(ls --full-time -u "$filename" | cut -d' ' -f6-8) > > touch -a --date="$origtime" "$filename" > > > > (though it might need a bit more testing). > > > > i suppose you could make this happen in /usr/lib/chkrootkit/check_php > > a thought --- would a better way be to make the daily run have a read-only > > filesystem? i think systemd can do that with hardening dirctives and it might > > avoid a lot of work. > > That's an interesting possibility I wasn't aware of. If that can be > done, it would be perfect. I think all it needs is /etc/systemd/system/chkrootkit.service.d/override.conf with [Service] ProtectSystem=strict (you can do "systemctl edit chkrootkit.service" and it will make such a file and reload it, you can then do systemctl start chkrootkit and it should be used) That should solve the problem for the daily check. Can you see if that it works. it's probably useful anyway)
Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-09 13:50 +0100
Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-09 23:50 +0100
Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-10 10:20 +0100
Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-10 14:20 +0100
Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-11 17:00 +0100
Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-12 00:50 +0100
Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-15 23:50 +0100
Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-28 22:20 +0100
Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-30 14:20 +0100
csiph-web