Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1267883 > unrolled thread
| Started by | Vincent Lefevre <vincent@vinc17.net> |
|---|---|
| First post | 2025-10-27 02:40 +0100 |
| Last post | 2025-10-29 10:40 +0100 |
| Articles | 3 — 2 participants |
Back to article view | Back to linux.debian.bugs.dist
Bug#1119116: chkrootkit: false alert due to spurious "No such file or directory" from /usr/bin/find Vincent Lefevre <vincent@vinc17.net> - 2025-10-27 02:40 +0100
Bug#1119116: chkrootkit: false alert due to spurious "No such file or directory" from /usr/bin/find Richard Lewis <richard.lewis.debian@googlemail.com> - 2025-10-29 09:50 +0100
Bug#1119116: chkrootkit: false alert due to spurious "No such file or directory" from /usr/bin/find Vincent Lefevre <vincent@vinc17.net> - 2025-10-29 10:40 +0100
| From | Vincent Lefevre <vincent@vinc17.net> |
|---|---|
| Date | 2025-10-27 02:40 +0100 |
| Subject | Bug#1119116: chkrootkit: false alert due to spurious "No such file or directory" from /usr/bin/find |
| Message-ID | <LKknf-8eje-1@gated-at.bofh.it> |
Package: chkrootkit
Version: 0.57-2+b6
Severity: normal
I got the following alert:
------------------------------------------------------------------------
Subject: [chkrootkit] alert for joooj.vinc17.net
chkrootkit output was not as expected.
The difference is:
--- [ BEGIN: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] ---
--- /var/log/chkrootkit/log.expected 2024-11-24 18:41:09.278624066 +0100
+++ /var/log/chkrootkit/log.today 2025-10-27 00:00:50.680156479 +0100
@@ -144,7 +144,8 @@
Searching for RotaJakiro backdoor rootkit... not found
Searching for Syslogk LKM rootkit... not found
Searching for Kovid LKM rootkit... not tested
-Searching for suspect PHP files... not found
+Searching for suspect PHP files... /usr/bin/find: ‘/var/tmp/systemd-private-f40df39b74cd464c8f5ac59a4648f5a6-logrotate.service-gDYDJi’: No such file or directory
+not found
Searching for zero-size shell history files... not tested
Searching for hardlinked shell history files... not tested
Checking `aliens'... finished
--- [ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] ---
To update the expected output, run (as root)
# cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected
# (note that unedited output is in /var/log/chkrootkit/log.today.raw)
------------------------------------------------------------------------
"No such file or directory" warnings from /usr/bin/find should be
filtered out.
-- System Information:
Debian Release: 12.12
APT prefers oldstable-updates
APT policy: (500, 'oldstable-updates'), (500, 'oldstable-security'), (500, 'oldstable-debug'), (500, 'oldstable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.1.0-40-amd64 (SMP w/1 CPU thread; PREEMPT)
Kernel taint flags: TAINT_WARN
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages chkrootkit depends on:
ii libc6 2.36-9+deb12u13
Versions of packages chkrootkit recommends:
ii binutils 2.40-2
ii bsd-mailx [mailx] 8.1.2-0.20220412cvs-1
ii cron [cron-daemon] 3.0pl1-162
ii iproute2 6.1.0-3
ii mailutils [mailx] 1:3.15-4
ii net-tools 2.10-0.1+deb12u2
ii postfix [mail-transport-agent] 3.7.11-0+deb12u1
ii procps 2:4.0.2-3
ii systemd-sysv 252.39-1~deb12u1
chkrootkit suggests no packages.
-- Configuration Files:
/etc/chkrootkit/chkrootkit.conf changed:
RUN_DAILY="true"
RUN_DAILY_OPTS=""
DIFF_MODE="true"
FILTER="sed -re 's![[:alnum:]]+: PACKET SNIFFER\(((/lib/systemd/systemd-networkd|(/usr)?/sbin/(dhclient|dhcpc?d[0-9]*|wpa_supplicant|NetworkManager))\[[0-9]+\](, )?)+\)!<interface>: PACKET SNIFFER\([systemd-networkd|dhclient|dhcpd|dhcpcd|wpa_supplicant|NetworkManager]{PID}\)!' -e 's/(! [[:alnum:]+-]+)\s+[0-9]+/\1 {PID}/' -e '/^Checking/{x;s/.*//;x};/^Checking.*bindshell/h;x;/./{x;d};x'"
IGNORE_FILE="/etc/chkrootkit/chkrootkit.ignore"
MAILTO="root"
-- no debconf information
--
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
[toc] | [next] | [standalone]
| From | Richard Lewis <richard.lewis.debian@googlemail.com> |
|---|---|
| Date | 2025-10-29 09:50 +0100 |
| Message-ID | <LLa2t-8QCt-5@gated-at.bofh.it> |
| In reply to | #1267883 |
[Multipart message — attachments visible in raw view] — view raw
On Mon, 27 Oct 2025, 01:35 Vincent Lefevre, <vincent@vinc17.net> wrote: > > -Searching for suspect PHP files... not found > +Searching for suspect PHP files... > /usr/bin/find: > ‘/var/tmp/systemd-private-f40df39b74cd464c8f5ac59a4648f5a6-logrotate.service-gDYDJi’: > No such file or directory > +not found > > "No such file or directory" warnings from /usr/bin/find should be > filtered out. maybe - is this just a (rather unlikely?) race where the file was removed by systemd halfway through? or is there a way to reproduce it?
[toc] | [prev] | [next] | [standalone]
| From | Vincent Lefevre <vincent@vinc17.net> |
|---|---|
| Date | 2025-10-29 10:40 +0100 |
| Message-ID | <LLaOR-8Rb3-7@gated-at.bofh.it> |
| In reply to | #1268219 |
On 2025-10-29 08:42:46 +0000, Richard Lewis wrote: > maybe - is this just a (rather unlikely?) race where the file was removed > by systemd halfway through? or is there a way to reproduce it? Yes, probably a race condition. It is a unlikely (at least on this machine under usual conditions), but it can occur in practice, and it is very easy to reproduce the race condition with the following zsh script running in /var/tmp: while true ; do d=dir-$RANDOM ; mkdir $d ; rmdir $d ; done Searching for suspect PHP files... /bin/find: ‘/var/tmp/dir-24416’: No such file or directory not found So, if some machine has some process running that involves a series of creation and removal of directories, this could trigger the error. This is particularly bad as a non-root user can perturb chkrootkit (intentionally or not). BTW, I ran the above script as a normal user. -- Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/> 100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/> Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.bugs.dist
csiph-web