Wildcards in Whitelists Do Not Function Correctly on Hidden Directories (Begin with a Period)

[Jared Fernandez]

apt-cache policy rkhunter:
rkhunter:
  Installed: 1.4.2-0.4
  Candidate: 1.4.2-0.4

lsb_release -rd:
Description: Ubuntu 15.04
Release: 15.04

Whitelisting files/directories with wildcards in the ALLOWDEVFILE parameter not working as expected and are still reported as suspicious:

In /etc/rkhunter.conf:
ALLOWDEVFILE=/dev/shm/byobu-*

Output:
Warning: Suspicious file types found in /dev:
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/updates_available: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/hostname: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/whoami: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/disk: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/memory: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/cpu_freq: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/cpu_count: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/load_average: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/cpu_temp: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/uptime: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/users: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/session: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/arch: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/release: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/distro: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/logo: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/network: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/width: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/cpu_freq: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/load_average: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/cpu_count: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/users: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/disk: ASCII text, with very long lines, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/memory: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/cpu_temp: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/uptime: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/hostname: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/release: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/whoami: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/session: very short file (no magic)
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/arch: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/distro: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/logo: UTF-8 Unicode text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/updates-available: ASCII text
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/network.down: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/network.down.dev: ASCII text
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/network.up: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/network.up.dev: ASCII text

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Roger Binns (ubuntu-rogerbinns)]

Some of them go away when you include wildcards. I have this in rkhunter.conf:

ALLOWDEVFILE=/dev/shm/byobu-*/*/*

That suppresses most of the warnings, with some remaining due to being hidden files or directories.

[Jared Fernandez (jared-fernandez)]

I was able to solve the issue I was seeing here by changing the rkhunter configuration to include the following lines:

ALLOWDEVFILE=/dev/shm/byobu-*-????????/.last.tmux/*
ALLOWDEVFILE=/dev/shm/byobu-*-????????/*/*
ALLOWDEVFILE=/dev/shm/byobu-*-????????/*
ALLOWDEVFILE=/dev/shm/sem.*

There are two things at play here:

1.) As Roger Binns pointed out, the asterisk at the end of the line is only good for a single directory level of wildcard match, so to match all the levels, multiple lines must be added, one for each level.

2.) The wildcard match does not appear to be working correctly for directories that start with a period (such as .last.tmux), which I do believe to actually be a bug. By manually specifying ".last.tmux" instead of an asterisk for that level, the ALLOWDEVFILE declaration will then function correctly.

In my case, I used the question marks to limit what is to be whitelisted since the string here will always be exactly 8 characters. For extra security, if you have very few users that login (or only a single user), rather than using an asterisk after the "byobu-", you could manually specify the allowed user here to narrow down the whitelist even further.

I will update the title on this bug to reflect the issue of the wildcard not matching directories that begin with a period.

[latimerio (fomember)]

I have the same problem with ASCII text with no line terminators on ubuntu 18.04 LTS.
I do not see what is wrong having no line terminators in an ASCII file.
So please make this at least a configurable ALLOW option.
I also get messages like below which I also think should be allowed

 /dev/shm/byobu-myuser-CLwl8Ngj/status.tmux/session: very short file (no magic)
 /dev/shm/byobu-myuser-CLwl8Ngj/status.tmux/disk: ASCII text, with very long lines, with no line terminators
  dev/shm/byobu-myuser-CLwl8Ngj/sockets: ASCII text