rkhunter Reports Its Own tmp Files As Suspicious When Run From Cron

[Jared Fernandez]

When run from the default Ubuntu cron file (/etc/cron.daily/rkhunter), if the option 'suspscan' is included, rkhunter reports the tmp file created by its own cron job as suspicious:

Warning: File '/tmp/tmp.Vnv2CeoUes' (score: 230) contains some suspicious content and should be checked.
Warning: Checking for files with suspicious contents [ Warning ]

This is caused by using 'mktmp' in the cron bash script which by default puts temp files in '/tmp'. The solution is to change the line

OUTFILE=`mktemp` || exit 1

to

OUTFILE=`mktemp -p /var/lib/rkhunter/tmp` || exit 1

so that the temp file is put in rkhunter's whitelisted tmp directory.

[François Marier (fmarier)]

Reported upstream: https://sourceforge.net/p/rkhunter/bugs/137/

[Jared Fernandez (jared-fernandez)]

This bug is specific to the Ubuntu/Debian-specific cron file located at /etc/cron.daily/rkhunter

[Jared Fernandez (jared-fernandez)]

Interestingly, this problem no longer occurs in the latest version (1.4.2-0.4) shipped with 15.04 Vivid. They must have changed the way that tmp files are scanned. Closing as WontFix.

[Jared Fernandez (jared-fernandez)]

I'm unable to change the status to WontFix myself. Feel free to close this one out.