Groups > linux.debian.bugs.dist > #1268229

Bug#1119116: chkrootkit: false alert due to spurious "No such file or directory" from /usr/bin/find

From	Vincent Lefevre <vincent@vinc17.net>
Newsgroups	linux.debian.bugs.dist
Subject	Bug#1119116: chkrootkit: false alert due to spurious "No such file or directory" from /usr/bin/find
Date	2025-10-29 10:40 +0100
Message-ID	<LLaOR-8Rb3-7@gated-at.bofh.it> (permalink)
References	<LKknf-8eje-1@gated-at.bofh.it> <LLa2t-8QCt-5@gated-at.bofh.it> <LKknf-8eje-1@gated-at.bofh.it> <LLa2t-8QCt-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 2025-10-29 08:42:46 +0000, Richard Lewis wrote:
> maybe - is this just a (rather unlikely?) race where the file was removed
> by systemd halfway through? or is there a way to reproduce it?

Yes, probably a race condition. It is a unlikely (at least on this
machine under usual conditions), but it can occur in practice, and
it is very easy to reproduce the race condition with the following
zsh script running in /var/tmp:

  while true ; do d=dir-$RANDOM ; mkdir $d ; rmdir $d ; done

Searching for suspect PHP files...                          /bin/find: ‘/var/tmp/dir-24416’: No such file or directory
not found

So, if some machine has some process running that involves a series
of creation and removal of directories, this could trigger the error.
This is particularly bad as a non-root user can perturb chkrootkit
(intentionally or not). BTW, I ran the above script as a normal user.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#1119116: chkrootkit: false alert due to spurious "No such file or directory" from /usr/bin/find Vincent Lefevre <vincent@vinc17.net> - 2025-10-27 02:40 +0100
  Bug#1119116: chkrootkit: false alert due to spurious "No such file or directory" from /usr/bin/find Richard Lewis <richard.lewis.debian@googlemail.com> - 2025-10-29 09:50 +0100
    Bug#1119116: chkrootkit: false alert due to spurious "No such file or directory" from /usr/bin/find Vincent Lefevre <vincent@vinc17.net> - 2025-10-29 10:40 +0100

csiph-web