cron.daily/chkrootkit log filtering needs to include current names for dhcpcd and dhclient binaries
Bug #1303893 reported by
Nathan Stratton Treadway
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
chkrootkit |
Fix Released
|
Unknown
|
|||
chkrootkit (Ubuntu) |
Fix Released
|
Low
|
Unassigned | ||
Bug Description
the cron.daily/
Changed in chkrootkit: | |
status: | Unknown → New |
Changed in chkrootkit: | |
status: | New → Fix Committed |
Changed in chkrootkit: | |
status: | Fix Committed → Fix Released |
Changed in chkrootkit (Ubuntu): | |
status: | New → Triaged |
importance: | Undecided → Low |
tags: | added: server-next |
To post a comment you must log in.
We have found that chkrootkit now complains after each reboot, with a message similar to: /sbin/dhclient[ 895]) /sbin/dhclient[ 888]) chkrootkit/ log.expected /var/log/ chkrootkit/ log.today ] ---
-eth0: PACKET SNIFFER(
+eth0: PACKET SNIFFER(
---[ END: diff -u /var/log/
Looking at /etc/cron. daily/chkrootki t, I noticed that there is logic that attempts to avoid such warnings: 0|1)(:[ 0-9])?: PACKET SNIFFER\ ((/sbin/ dhclient3| /usr/sbin/ dhcpd3) \[[0-9] +\]\),eth\ [0|1\]: PACKET SNIFFER\ ([dhclient3| dhcpd3] {PID}\) ,' \
-e 's/(! \w+\s+)[ 0-9]{4} [0-9]/\ 1#####/ ' $LOG_DIR/ log.today. raw > $LOG_DIR/log.today
# the sed expression replaces the messages about /sbin/dhclient3 /usr/sbin/dhcpd3
# with a message that is the same whatever order eth0 and eth1 were scanned
sed -r -e 's,eth(
... but this no longer works as expected, since the exact name of the "dhclient' binary has changed.