Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1223620

Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles

Show all headers | View raw

On Tue, Dec 10, 2024 at 01:10:16PM +0000, Richard Lewis wrote:
> On Tue, 10 Dec 2024, 09:10 Julian Gilbey, <jdg@debian.org> wrote:
> 
>   On Mon, Dec 09, 2024 at 10:45:40PM +0000, Richard Lewis wrote:
>   > On Mon, 9 Dec 2024, 12:42 Julian Gilbey, <jdg@debian.org> wrote:
>   > chkrootkit updates the
>   >   access times of all the files in /tmp
> 
>   >   it to that time afterwards (presumably using utimes(2) or similar).
> 
>   Something like this should work in a shell script:
> 
>   origtime=$(ls --full-time -u "$filename" | cut -d' ' -f6-8)
>   touch -a --date="$origtime" "$filename"
> 
>   (though it might need a bit more testing).
> 
> i suppose you could make this happen in /usr/lib/chkrootkit/check_php
> a thought --- would a better way be to make the daily run have a read-only
> filesystem? i think systemd can do that with hardening dirctives and it might
> avoid a lot of work. 

That's an interesting possibility I wasn't aware of.  If that can be
done, it would be perfect.

> Otherwise you would need to make this work with the -p -r and -e options (and we
> will continue to pretend not to notice -x ), and provide tests

(I'm not sure whether this means that I (Julian) would need to make it
work, or whether it means that someone would have to make it work.  I
don't have the capacity to work on this myself, I'm afraid.)

Best wishes,

   Julian

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-09 13:50 +0100
  Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-09 23:50 +0100
    Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-10 10:20 +0100
      Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-10 14:20 +0100
        Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-11 17:00 +0100
          Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-12 00:50 +0100
            Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Julian Gilbey <jdg@debian.org> - 2024-12-15 23:50 +0100
  Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-28 22:20 +0100
  Bug#1089588: chkrootkit: updates access times of /tmp/* and lots more, breaking systemd-tmpfiles Richard Lewis <richard.lewis.debian@googlemail.com> - 2024-12-30 14:20 +0100

csiph-web