cron.daily/chkrootkit log filtering needs to include current names for dhcpcd and dhclient binaries

Bug #1303893 reported by Nathan Stratton Treadway
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
chkrootkit
Fix Released
Unknown
chkrootkit (Ubuntu)
Fix Released
Low
Unassigned
Nominated for Bionic by Andreas Hasenack

Bug Description

the cron.daily/chkrootkit script's current logic for simplifying the PACKET SNIFFER lines for dhclient and dhcpcd processes needs to be updated to include the names of current versions of those binaries.

Revision history for this message
Nathan Stratton Treadway (nathanst) wrote :

We have found that chkrootkit now complains after each reboot, with a message similar to:
-eth0: PACKET SNIFFER(/sbin/dhclient[895])
+eth0: PACKET SNIFFER(/sbin/dhclient[888])
---[ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] ---

Looking at /etc/cron.daily/chkrootkit, I noticed that there is logic that attempts to avoid such warnings:
     # the sed expression replaces the messages about /sbin/dhclient3 /usr/sbin/dhcpd3
     # with a message that is the same whatever order eth0 and eth1 were scanned
     sed -r -e 's,eth(0|1)(:[0-9])?: PACKET SNIFFER\((/sbin/dhclient3|/usr/sbin/dhcpd3)\[[0-9]+\]\),eth\[0|1\]: PACKET SNIFFER\([dhclient3|dhcpd3]{PID}\),' \
                                -e 's/(! \w+\s+)[ 0-9]{4}[0-9]/\1#####/' $LOG_DIR/log.today.raw > $LOG_DIR/log.today

... but this no longer works as expected, since the exact name of the "dhclient' binary has changed.

Changed in chkrootkit:
status: Unknown → New
Changed in chkrootkit:
status: New → Fix Committed
Changed in chkrootkit:
status: Fix Committed → Fix Released
Revision history for this message
Christian Ehrhardt  (paelzer) wrote :

Note: Will be picked up by auto-syncing packages once 18.04 is fully released and the freeze lifted

Changed in chkrootkit (Ubuntu):
status: New → Triaged
importance: Undecided → Low
tags: added: server-next
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

This is fixed in Cosmic, which now has 0.52-2

Changed in chkrootkit (Ubuntu):
status: Triaged → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.