Wildcards in Whitelists Do Not Function Correctly on Hidden Directories (Begin with a Period)

Bug #1453952 reported by Jared Fernandez on 2015-05-11
18
This bug affects 4 people
Affects Status Importance Assigned to Milestone
rkhunter (Ubuntu)
Medium
Unassigned

Bug Description

apt-cache policy rkhunter:
rkhunter:
  Installed: 1.4.2-0.4
  Candidate: 1.4.2-0.4

lsb_release -rd:
Description: Ubuntu 15.04
Release: 15.04

Whitelisting files/directories with wildcards in the ALLOWDEVFILE parameter not working as expected and are still reported as suspicious:

In /etc/rkhunter.conf:
ALLOWDEVFILE=/dev/shm/byobu-*

Output:
Warning: Suspicious file types found in /dev:
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/updates_available: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/hostname: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/whoami: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/disk: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/memory: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/cpu_freq: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/cpu_count: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/load_average: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/cpu_temp: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/uptime: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/users: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/session: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/arch: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/release: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/distro: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/logo: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/network: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/width: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/cpu_freq: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/load_average: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/cpu_count: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/users: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/disk: ASCII text, with very long lines, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/memory: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/cpu_temp: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/uptime: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/hostname: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/release: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/whoami: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/session: very short file (no magic)
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/arch: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/distro: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/logo: UTF-8 Unicode text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/updates-available: ASCII text
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/network.down: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/network.down.dev: ASCII text
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/network.up: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/network.up.dev: ASCII text

Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in rkhunter (Ubuntu):
status: New → Confirmed
Roger Binns (ubuntu-rogerbinns) wrote :

Some of them go away when you include wildcards. I have this in rkhunter.conf:

ALLOWDEVFILE=/dev/shm/byobu-*/*/*

That suppresses most of the warnings, with some remaining due to being hidden files or directories.

Changed in rkhunter (Ubuntu):
importance: Undecided → Medium

I was able to solve the issue I was seeing here by changing the rkhunter configuration to include the following lines:

ALLOWDEVFILE=/dev/shm/byobu-*-????????/.last.tmux/*
ALLOWDEVFILE=/dev/shm/byobu-*-????????/*/*
ALLOWDEVFILE=/dev/shm/byobu-*-????????/*
ALLOWDEVFILE=/dev/shm/sem.*

There are two things at play here:

1.) As Roger Binns pointed out, the asterisk at the end of the line is only good for a single directory level of wildcard match, so to match all the levels, multiple lines must be added, one for each level.

2.) The wildcard match does not appear to be working correctly for directories that start with a period (such as .last.tmux), which I do believe to actually be a bug. By manually specifying ".last.tmux" instead of an asterisk for that level, the ALLOWDEVFILE declaration will then function correctly.

In my case, I used the question marks to limit what is to be whitelisted since the string here will always be exactly 8 characters. For extra security, if you have very few users that login (or only a single user), rather than using an asterisk after the "byobu-", you could manually specify the allowed user here to narrow down the whitelist even further.

I will update the title on this bug to reflect the issue of the wildcard not matching directories that begin with a period.

summary: - Wildcards in "ALLOWDEVFILE" Not Working
+ Wildcards in Whitelists Do Not Function Correctly on Hidden Directories
+ (Begin with a Period)
latimerio (fomember) wrote :

I have the same problem with ASCII text with no line terminators on ubuntu 18.04 LTS.
I do not see what is wrong having no line terminators in an ASCII file.
So please make this at least a configurable ALLOW option.
I also get messages like below which I also think should be allowed

 /dev/shm/byobu-myuser-CLwl8Ngj/status.tmux/session: very short file (no magic)
 /dev/shm/byobu-myuser-CLwl8Ngj/status.tmux/disk: ASCII text, with very long lines, with no line terminators
  dev/shm/byobu-myuser-CLwl8Ngj/sockets: ASCII text

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers