RUN: /usr/share/launchpad-buildd/slavebin/slave-prep ['slave-prep'] Forking launchpad-buildd slave process... Kernel version: 3.2.0-1427-omap4 #36-Ubuntu SMP PREEMPT Fri Mar 1 18:08:27 UTC 2013 armv7l Buildd toolchain package versions: launchpad-buildd_114-0~53~0.IS.08.04 python-lpbuildd_114-0~53~0.IS.08.04 bzr_2.5.1-0ubuntu2. Syncing the system clock with the buildd NTP service... 28 Apr 21:41:14 ntpdate[8945]: adjust time server 10.211.37.1 offset 0.003634 sec RUN: /usr/share/launchpad-buildd/slavebin/unpack-chroot ['unpack-chroot', 'b8a69cb8429c6fdffe2a7919f17981bbff9b2573', '/home/buildd/filecache-default/c1642874d134beaf360e15c181533eaa0f42b681'] Unpacking chroot for build b8a69cb8429c6fdffe2a7919f17981bbff9b2573 RUN: /usr/share/launchpad-buildd/slavebin/mount-chroot ['mount-chroot', 'b8a69cb8429c6fdffe2a7919f17981bbff9b2573'] Mounting chroot for build b8a69cb8429c6fdffe2a7919f17981bbff9b2573 RUN: /usr/share/launchpad-buildd/slavebin/override-sources-list ['override-sources-list', 'b8a69cb8429c6fdffe2a7919f17981bbff9b2573', 'deb http://ftpmaster.internal/ubuntu saucy main universe', 'deb http://ftpmaster.internal/ubuntu saucy-security main universe', 'deb http://ftpmaster.internal/ubuntu saucy-updates main universe', 'deb http://ftpmaster.internal/ubuntu saucy-proposed main universe'] Overriding sources.list in build-b8a69cb8429c6fdffe2a7919f17981bbff9b2573 RUN: /usr/share/launchpad-buildd/slavebin/update-debian-chroot ['update-debian-chroot', 'b8a69cb8429c6fdffe2a7919f17981bbff9b2573', 'armhf'] Updating debian chroot for build b8a69cb8429c6fdffe2a7919f17981bbff9b2573 Ign http://archive-team.internal saucy Release.gpg Get:1 http://archive-team.internal saucy Release [728 B] Get:2 http://ftpmaster.internal saucy Release.gpg [933 B] Get:3 http://ftpmaster.internal saucy-security Release.gpg [933 B] Get:4 http://ftpmaster.internal saucy-updates Release.gpg [933 B] Get:5 http://ftpmaster.internal saucy-proposed Release.gpg [933 B] Get:6 http://ftpmaster.internal saucy Release [40.8 kB] Get:7 http://archive-team.internal saucy/main armhf Packages Get:8 http://ftpmaster.internal saucy-security Release [40.8 kB] Get:9 http://ftpmaster.internal saucy-updates Release [40.8 kB] Get:10 http://ftpmaster.internal saucy-proposed Release [40.8 kB] Ign http://archive-team.internal saucy/main Translation-en Get:11 http://ftpmaster.internal saucy/main armhf Packages [1162 kB] Get:12 http://ftpmaster.internal saucy/universe armhf Packages [5257 kB] Get:13 http://ftpmaster.internal saucy/main Translation-en [684 kB] Get:14 http://ftpmaster.internal saucy/universe Translation-en [3736 kB] Get:15 http://ftpmaster.internal saucy-security/main armhf Packages [14 B] Get:16 http://ftpmaster.internal saucy-security/universe armhf Packages [14 B] Get:17 http://ftpmaster.internal saucy-security/main Translation-en [14 B] Get:18 http://ftpmaster.internal saucy-security/universe Translation-en [14 B] Get:19 http://ftpmaster.internal saucy-updates/main armhf Packages [14 B] Get:20 http://ftpmaster.internal saucy-updates/universe armhf Packages [14 B] Get:21 http://ftpmaster.internal saucy-updates/main Translation-en [14 B] Get:22 http://ftpmaster.internal saucy-updates/universe Translation-en [14 B] Get:23 http://ftpmaster.internal saucy-proposed/main armhf Packages [5767 B] Get:24 http://ftpmaster.internal saucy-proposed/universe armhf Packages [64.6 kB] Get:25 http://ftpmaster.internal saucy-proposed/main Translation-en [5345 B] Get:26 http://ftpmaster.internal saucy-proposed/universe Translation-en [43.3 kB] Fetched 11.1 MB in 31s (355 kB/s) Reading package lists... Reading package lists... Building dependency tree... Reading state information... The following packages will be upgraded: advancecomp libdbus-1-3 libgssapi-krb5-2 libk5crypto3 libkeyutils1 libkrb5-3 libkrb5support0 libudev1 linux-libc-dev 9 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. Need to get 1797 kB of archives. After this operation, 81.9 kB of additional disk space will be used. WARNING: The following packages cannot be authenticated! libdbus-1-3 libudev1 libkeyutils1 libk5crypto3 libgssapi-krb5-2 libkrb5-3 libkrb5support0 advancecomp linux-libc-dev Authentication warning overridden. Get:1 http://ftpmaster.internal/ubuntu/ saucy/main libdbus-1-3 armhf 1.6.8-1ubuntu7 [124 kB] Get:2 http://ftpmaster.internal/ubuntu/ saucy/main libudev1 armhf 198-0ubuntu12 [31.8 kB] Get:3 http://ftpmaster.internal/ubuntu/ saucy/main libkeyutils1 armhf 1.5.5-7 [6568 B] Get:4 http://ftpmaster.internal/ubuntu/ saucy/main libk5crypto3 armhf 1.10.1+dfsg-5 [76.4 kB] Get:5 http://ftpmaster.internal/ubuntu/ saucy/main libgssapi-krb5-2 armhf 1.10.1+dfsg-5 [94.8 kB] Get:6 http://ftpmaster.internal/ubuntu/ saucy/main libkrb5-3 armhf 1.10.1+dfsg-5 [298 kB] Get:7 http://ftpmaster.internal/ubuntu/ saucy/main libkrb5support0 armhf 1.10.1+dfsg-5 [19.9 kB] Get:8 http://ftpmaster.internal/ubuntu/ saucy/main advancecomp armhf 1.16-1 [255 kB] Get:9 http://ftpmaster.internal/ubuntu/ saucy-proposed/main linux-libc-dev armhf 3.9.0-0.1 [891 kB] debconf: delaying package configuration, since apt-utils is not installed Fetched 1797 kB in 0s (3277 kB/s) (Reading database ... 11895 files and directories currently installed.) Preparing to replace libdbus-1-3:armhf 1.6.8-1ubuntu6 (using .../libdbus-1-3_1.6.8-1ubuntu7_armhf.deb) ... Unpacking replacement libdbus-1-3:armhf ... Preparing to replace libudev1:armhf 198-0ubuntu11 (using .../libudev1_198-0ubuntu12_armhf.deb) ... Unpacking replacement libudev1:armhf ... Preparing to replace libkeyutils1:armhf 1.5.5-4 (using .../libkeyutils1_1.5.5-7_armhf.deb) ... Unpacking replacement libkeyutils1:armhf ... Preparing to replace libk5crypto3:armhf 1.10.1+dfsg-4+nmu1 (using .../libk5crypto3_1.10.1+dfsg-5_armhf.deb) ... Unpacking replacement libk5crypto3:armhf ... Preparing to replace libgssapi-krb5-2:armhf 1.10.1+dfsg-4+nmu1 (using .../libgssapi-krb5-2_1.10.1+dfsg-5_armhf.deb) ... Unpacking replacement libgssapi-krb5-2:armhf ... Preparing to replace libkrb5-3:armhf 1.10.1+dfsg-4+nmu1 (using .../libkrb5-3_1.10.1+dfsg-5_armhf.deb) ... Unpacking replacement libkrb5-3:armhf ... Preparing to replace libkrb5support0:armhf 1.10.1+dfsg-4+nmu1 (using .../libkrb5support0_1.10.1+dfsg-5_armhf.deb) ... Unpacking replacement libkrb5support0:armhf ... Preparing to replace advancecomp 1.15-1build1 (using .../advancecomp_1.16-1_armhf.deb) ... Unpacking replacement advancecomp ... Preparing to replace linux-libc-dev:armhf 3.8.0-19.29 (using .../linux-libc-dev_3.9.0-0.1_armhf.deb) ... Unpacking replacement linux-libc-dev:armhf ... Setting up libdbus-1-3:armhf (1.6.8-1ubuntu7) ... Setting up libudev1:armhf (198-0ubuntu12) ... Setting up libkeyutils1:armhf (1.5.5-7) ... Setting up libkrb5support0:armhf (1.10.1+dfsg-5) ... Setting up libk5crypto3:armhf (1.10.1+dfsg-5) ... Setting up libkrb5-3:armhf (1.10.1+dfsg-5) ... Setting up libgssapi-krb5-2:armhf (1.10.1+dfsg-5) ... Setting up advancecomp (1.16-1) ... Setting up linux-libc-dev:armhf (3.9.0-0.1) ... Processing triggers for libc-bin ... ldconfig deferred processing now taking place RUN: /usr/share/launchpad-buildd/slavebin/sbuild-package ['sbuild-package', 'b8a69cb8429c6fdffe2a7919f17981bbff9b2573', 'armhf', 'saucy-proposed', '--nolog', '--batch', '--archive=ubuntu', '--dist=saucy-proposed', '--purpose=PRIMARY', '--architecture=armhf', '--comp=universe', 'unhide_20121229-1.dsc'] Initiating build b8a69cb8429c6fdffe2a7919f17981bbff9b2573 with 2 jobs across 2 processor cores. Kernel reported to sbuild: 3.2.0-1427-omap4 #36-Ubuntu SMP PREEMPT Fri Mar 1 18:08:27 UTC 2013 armv7l Automatic build of unhide_20121229-1 on tritons by sbuild/armhf 1.170.5 Build started at 20130428-2143 ****************************************************************************** unhide_20121229-1.dsc exists in cwd ** Using build dependencies supplied by package: Build-Depends: debhelper (>= 8.0.0) Checking for already installed source dependencies... debhelper: missing Checking for source dependency conflicts... /usr/bin/sudo /usr/bin/apt-get --purge $CHROOT_OPTIONS -q -y install debhelper Reading package lists... Building dependency tree... Reading state information... The following extra packages will be installed: bsdmainutils dh-apparmor file gettext gettext-base groff-base html2text intltool-debian libasprintf-dev libasprintf0c2 libcroco3 libgettextpo-dev libgettextpo0 libmagic1 libpipeline1 libunistring0 libxml2 man-db po-debconf Suggested packages: wamerican wordlist whois vacation dh-make gettext-doc groff less www-browser libmail-box-perl Recommended packages: curl wget lynx-cur xml-core libmail-sendmail-perl The following NEW packages will be installed: bsdmainutils debhelper dh-apparmor file gettext gettext-base groff-base html2text intltool-debian libasprintf-dev libasprintf0c2 libcroco3 libgettextpo-dev libgettextpo0 libmagic1 libpipeline1 libunistring0 libxml2 man-db po-debconf 0 upgraded, 20 newly installed, 0 to remove and 0 not upgraded. Need to get 4864 kB of archives. After this operation, 15.7 MB of additional disk space will be used. WARNING: The following packages cannot be authenticated! libmagic1 libasprintf0c2 libpipeline1 libxml2 groff-base bsdmainutils man-db libcroco3 libunistring0 libgettextpo0 file gettext-base html2text libasprintf-dev libgettextpo-dev gettext intltool-debian po-debconf dh-apparmor debhelper Authentication warning overridden. Get:1 http://ftpmaster.internal/ubuntu/ saucy/main libmagic1 armhf 5.11-2ubuntu4 [167 kB] Get:2 http://ftpmaster.internal/ubuntu/ saucy/main libasprintf0c2 armhf 0.18.1.1-10ubuntu3 [6544 B] Get:3 http://ftpmaster.internal/ubuntu/ saucy/main libpipeline1 armhf 1.2.3-1 [21.2 kB] Get:4 http://ftpmaster.internal/ubuntu/ saucy/main libxml2 armhf 2.9.0+dfsg1-4ubuntu4 [563 kB] Get:5 http://ftpmaster.internal/ubuntu/ saucy/main groff-base armhf 1.22.2-2 [648 kB] Get:6 http://ftpmaster.internal/ubuntu/ saucy/main bsdmainutils armhf 9.0.4ubuntu3 [196 kB] Get:7 http://ftpmaster.internal/ubuntu/ saucy/main man-db armhf 2.6.3-3 [611 kB] Get:8 http://ftpmaster.internal/ubuntu/ saucy/main libcroco3 armhf 0.6.8-1 [68.9 kB] Get:9 http://ftpmaster.internal/ubuntu/ saucy/main libunistring0 armhf 0.9.3-5build1 [395 kB] Get:10 http://ftpmaster.internal/ubuntu/ saucy/main libgettextpo0 armhf 0.18.1.1-10ubuntu3 [101 kB] Get:11 http://ftpmaster.internal/ubuntu/ saucy/main file armhf 5.11-2ubuntu4 [17.9 kB] Get:12 http://ftpmaster.internal/ubuntu/ saucy/main gettext-base armhf 0.18.1.1-10ubuntu3 [53.5 kB] Get:13 http://ftpmaster.internal/ubuntu/ saucy/main html2text armhf 1.3.2a-15ubuntu3 [81.1 kB] Get:14 http://ftpmaster.internal/ubuntu/ saucy/main libasprintf-dev armhf 0.18.1.1-10ubuntu3 [4446 B] Get:15 http://ftpmaster.internal/ubuntu/ saucy/main libgettextpo-dev armhf 0.18.1.1-10ubuntu3 [119 kB] Get:16 http://ftpmaster.internal/ubuntu/ saucy/main gettext armhf 0.18.1.1-10ubuntu3 [931 kB] Get:17 http://ftpmaster.internal/ubuntu/ saucy/main intltool-debian all 0.35.0+20060710.1 [31.6 kB] Get:18 http://ftpmaster.internal/ubuntu/ saucy/main po-debconf all 1.0.16+nmu2ubuntu1 [210 kB] Get:19 http://ftpmaster.internal/ubuntu/ saucy/main dh-apparmor all 2.8.0-0ubuntu11 [8392 B] Get:20 http://ftpmaster.internal/ubuntu/ saucy/main debhelper all 9.20120909ubuntu1 [631 kB] debconf: delaying package configuration, since apt-utils is not installed Fetched 4864 kB in 1s (3417 kB/s) Selecting previously unselected package libmagic1:armhf. (Reading database ... 11897 files and directories currently installed.) Unpacking libmagic1:armhf (from .../libmagic1_5.11-2ubuntu4_armhf.deb) ... Selecting previously unselected package libasprintf0c2:armhf. Unpacking libasprintf0c2:armhf (from .../libasprintf0c2_0.18.1.1-10ubuntu3_armhf.deb) ... Selecting previously unselected package libpipeline1:armhf. Unpacking libpipeline1:armhf (from .../libpipeline1_1.2.3-1_armhf.deb) ... Selecting previously unselected package libxml2:armhf. Unpacking libxml2:armhf (from .../libxml2_2.9.0+dfsg1-4ubuntu4_armhf.deb) ... Selecting previously unselected package groff-base. Unpacking groff-base (from .../groff-base_1.22.2-2_armhf.deb) ... Selecting previously unselected package bsdmainutils. Unpacking bsdmainutils (from .../bsdmainutils_9.0.4ubuntu3_armhf.deb) ... Selecting previously unselected package man-db. Unpacking man-db (from .../man-db_2.6.3-3_armhf.deb) ... Selecting previously unselected package libcroco3:armhf. Unpacking libcroco3:armhf (from .../libcroco3_0.6.8-1_armhf.deb) ... Selecting previously unselected package libunistring0:armhf. Unpacking libunistring0:armhf (from .../libunistring0_0.9.3-5build1_armhf.deb) ... Selecting previously unselected package libgettextpo0:armhf. Unpacking libgettextpo0:armhf (from .../libgettextpo0_0.18.1.1-10ubuntu3_armhf.deb) ... Selecting previously unselected package file. Unpacking file (from .../file_5.11-2ubuntu4_armhf.deb) ... Selecting previously unselected package gettext-base. Unpacking gettext-base (from .../gettext-base_0.18.1.1-10ubuntu3_armhf.deb) ... Selecting previously unselected package html2text. Unpacking html2text (from .../html2text_1.3.2a-15ubuntu3_armhf.deb) ... Selecting previously unselected package libasprintf-dev:armhf. Unpacking libasprintf-dev:armhf (from .../libasprintf-dev_0.18.1.1-10ubuntu3_armhf.deb) ... Selecting previously unselected package libgettextpo-dev:armhf. Unpacking libgettextpo-dev:armhf (from .../libgettextpo-dev_0.18.1.1-10ubuntu3_armhf.deb) ... Selecting previously unselected package gettext. Unpacking gettext (from .../gettext_0.18.1.1-10ubuntu3_armhf.deb) ... Selecting previously unselected package intltool-debian. Unpacking intltool-debian (from .../intltool-debian_0.35.0+20060710.1_all.deb) ... Selecting previously unselected package po-debconf. Unpacking po-debconf (from .../po-debconf_1.0.16+nmu2ubuntu1_all.deb) ... Selecting previously unselected package dh-apparmor. Unpacking dh-apparmor (from .../dh-apparmor_2.8.0-0ubuntu11_all.deb) ... Selecting previously unselected package debhelper. Unpacking debhelper (from .../debhelper_9.20120909ubuntu1_all.deb) ... Setting up libmagic1:armhf (5.11-2ubuntu4) ... Setting up libasprintf0c2:armhf (0.18.1.1-10ubuntu3) ... Setting up libpipeline1:armhf (1.2.3-1) ... Setting up libxml2:armhf (2.9.0+dfsg1-4ubuntu4) ... Setting up groff-base (1.22.2-2) ... Setting up bsdmainutils (9.0.4ubuntu3) ... update-alternatives: using /usr/bin/bsd-write to provide /usr/bin/write (write) in auto mode update-alternatives: using /usr/bin/bsd-from to provide /usr/bin/from (from) in auto mode Setting up man-db (2.6.3-3) ... Building database of manual pages ... Setting up libcroco3:armhf (0.6.8-1) ... Setting up libunistring0:armhf (0.9.3-5build1) ... Setting up libgettextpo0:armhf (0.18.1.1-10ubuntu3) ... Setting up file (5.11-2ubuntu4) ... Setting up gettext-base (0.18.1.1-10ubuntu3) ... Setting up html2text (1.3.2a-15ubuntu3) ... Setting up libasprintf-dev:armhf (0.18.1.1-10ubuntu3) ... Setting up libgettextpo-dev:armhf (0.18.1.1-10ubuntu3) ... Setting up gettext (0.18.1.1-10ubuntu3) ... Setting up intltool-debian (0.35.0+20060710.1) ... Setting up po-debconf (1.0.16+nmu2ubuntu1) ... Setting up dh-apparmor (2.8.0-0ubuntu11) ... Setting up debhelper (9.20120909ubuntu1) ... Processing triggers for libc-bin ... ldconfig deferred processing now taking place Checking correctness of source dependencies... Toolchain package versions: libc6-dev_2.17-0ubuntu5 make_3.81-8.2ubuntu2 dpkg-dev_1.16.10ubuntu1 gcc-4.8_4.8.0-4ubuntu2 g++-4.8_4.8.0-4ubuntu2 binutils_2.23.2-2ubuntu1 libstdc++-4.8-dev_4.8.0-4ubuntu2 libstdc++6_4.8.0-4ubuntu2 ------------------------------------------------------------------------------ dpkg-source: warning: -sn is not a valid option for Dpkg::Source::Package::V3::quilt gpgv: Signature made Fri Feb 15 18:41:13 2013 UTC using RSA key ID D1C5AB3B gpgv: Can't check signature: public key not found dpkg-source: warning: failed to verify signature on ./unhide_20121229-1.dsc dpkg-source: info: extracting unhide in unhide-20121229 dpkg-source: info: unpacking unhide_20121229.orig.tar.gz dpkg-source: info: unpacking unhide_20121229-1.debian.tar.gz dpkg-source: info: applying 001_fix-manpages.diff dpkg-buildpackage: source package unhide dpkg-buildpackage: source version 20121229-1 dpkg-source --before-build unhide-20121229 dpkg-buildpackage: host architecture armhf /usr/bin/fakeroot debian/rules clean dh clean dh_testdir debian/rules override_dh_auto_clean make[1]: Entering directory `/build/buildd/unhide-20121229' dh_auto_clean rm -f unhide-linux unhide-posix unhide-tcp unhide_rb rm -f man/unhide.fr.8 man/unhide.es.8 make[1]: Leaving directory `/build/buildd/unhide-20121229' dh_clean debian/rules build-arch dh build-arch dh_testdir -a debian/rules override_dh_auto_configure make[1]: Entering directory `/build/buildd/unhide-20121229' ln man/fr/unhide.8 man/unhide.fr.8 ln man/es/unhide.8 man/unhide.es.8 make[1]: Leaving directory `/build/buildd/unhide-20121229' debian/rules override_dh_auto_build make[1]: Entering directory `/build/buildd/unhide-20121229' gcc -Wall -O2 --static -pthread unhide-linux*.c unhide-output.c -o unhide-linux gcc -Wall -O2 --static unhide-tcp.c unhide-tcp-fast.c unhide-output.c -o unhide-tcp gcc -Wall -O2 --static unhide_rb.c -o unhide_rb gcc --static unhide-posix.c -o unhide-posix make[1]: Leaving directory `/build/buildd/unhide-20121229' dh_auto_test -a /usr/bin/fakeroot debian/rules binary-arch dh binary-arch dh_testroot -a dh_prep -a dh_installdirs -a dh_auto_install -a dh_install -a dh_installdocs -a dh_installchangelogs -a dh_installexamples -a dh_installman -a dh_installcatalogs -a dh_installcron -a dh_installdebconf -a dh_installemacsen -a dh_installifupdown -a dh_installinfo -a dh_installinit -a dh_installmenu -a dh_installmime -a dh_installmodules -a dh_installlogcheck -a dh_installlogrotate -a dh_installpam -a dh_installppp -a dh_installudev -a dh_installwm -a dh_installxfonts -a dh_installgsettings -a dh_bugfiles -a dh_ucf -a dh_lintian -a dh_gconf -a dh_icons -a dh_perl -a dh_usrlocal -a dh_link -a dh_compress -a dh_fixperms -a dh_strip -a dh_strip debug symbol extraction: all non-arch-all packages for this build platform armhf: unhide dh_strip debug symbol extraction: packages to act on: unhide dh_strip debug symbol extraction: ignored packages: dpkg-gencontrol: warning: File::FcntlLock not available; using flock which is not NFS-safe dpkg-deb: building package `unhide-dbgsym' in `../unhide-dbgsym_20121229-1_armhf.ddeb'. dh_makeshlibs -a dh_shlibdeps -a dh_installdeb -a dh_gencontrol -a dpkg-gencontrol: warning: File::FcntlLock not available; using flock which is not NFS-safe dh_md5sums -a dh_builddeb -a INFO: pkgstriptranslations version 117 pkgstriptranslations: processing unhide (in debian/unhide); do_strip: , oemstrip: pkgmaintainermangler: Maintainer field overridden to "Ubuntu Developers " pkgstripfiles: processing control file: debian/unhide/DEBIAN/control, package unhide, directory debian/unhide pkgstripfiles: Truncating usr/share/doc/unhide/changelog.Debian.gz to topmost ten records pkgstripfiles: PNG optimization for package unhide took 0 s dpkg-deb: warning: 'debian/unhide/DEBIAN/control' contains user-defined field 'Original-Maintainer' dpkg-deb: warning: ignoring 1 warning about the control file(s) dpkg-deb: building package `unhide' in `../unhide_20121229-1_armhf.deb'. dpkg-genchanges -B -mUbuntu/armhf Build Daemon >../unhide_20121229-1_armhf.changes dpkg-genchanges: arch-specific upload - not including arch-independent packages dpkg-genchanges: binary-only upload - not including any source code dpkg-source --after-build unhide-20121229 dpkg-buildpackage: binary only upload (no source included) ****************************************************************************** Build finished at 20130428-2144 Publishing debug debs. chroot-autobuild/build/buildd/unhide_20121229-1_armhf.deb: new debian package, version 2.0. size 986568 bytes: control archive= 1573 bytes. 1336 bytes, 30 lines control 896 bytes, 14 lines md5sums 353 bytes, 23 lines * postinst #!/bin/sh 26 bytes, 1 lines triggers Package: unhide Version: 20121229-1 Architecture: armhf Maintainer: Ubuntu Developers Original-Maintainer: Debian Forensics Installed-Size: 1651 Suggests: rkhunter Section: admin Priority: extra Homepage: http://www.unhide-forensics.info Description: Forensic tool to find hidden processes and ports Unhide is a forensic tool to find processes and TCP/UDP ports hidden by rootkits, Linux kernel modules or by other techniques. It includes two utilities: unhide and unhide-tcp. . unhide detects hidden processes using the following six techniques: * Compare /proc vs /bin/ps output * Compare info gathered from /bin/ps with info gathered by walking thru the procfs. * Compare info gathered from /bin/ps with info gathered from syscalls (syscall scanning). * Full PIDs space occupation (PIDs bruteforcing) * Reverse search, verify that all thread seen by ps are also seen by the kernel (/bin/ps output vs /proc, procfs walking and syscall) * Quick compare /proc, procfs walking and syscall vs /bin/ps output . unhide-tcp identifies TCP/UDP ports that are listening but are not listed in /bin/netstat through brute forcing of all TCP/UDP ports available. . This package can be used by rkhunter in its daily scans. chroot-autobuild/build/buildd/unhide_20121229-1_armhf.deb: drwxr-xr-x root/root 0 2013-04-28 21:44 ./ drwxr-xr-x root/root 0 2013-04-28 21:44 ./usr/ drwxr-xr-x root/root 0 2013-04-28 21:44 ./usr/bin/ drwxr-xr-x root/root 0 2013-04-28 21:44 ./usr/share/ drwxr-xr-x root/root 0 2013-04-28 21:44 ./usr/share/man/ drwxr-xr-x root/root 0 2013-04-28 21:44 ./usr/share/man/es/ drwxr-xr-x root/root 0 2013-04-28 21:44 ./usr/share/man/es/man8/ -rw-r--r-- root/root 2396 2013-04-28 21:44 ./usr/share/man/es/man8/unhide.8.gz drwxr-xr-x root/root 0 2013-04-28 21:44 ./usr/share/man/fr/ drwxr-xr-x root/root 0 2013-04-28 21:44 ./usr/share/man/fr/man8/ -rw-r--r-- root/root 2550 2013-04-28 21:44 ./usr/share/man/fr/man8/unhide.8.gz drwxr-xr-x root/root 0 2013-04-28 21:44 ./usr/share/man/man8/ -rw-r--r-- root/root 2120 2013-04-28 21:44 ./usr/share/man/man8/unhide.8.gz -rw-r--r-- root/root 1099 2013-04-28 21:44 ./usr/share/man/man8/unhide-tcp.8.gz drwxr-xr-x root/root 0 2013-04-28 21:43 ./usr/share/doc/ drwxr-xr-x root/root 0 2013-04-28 21:44 ./usr/share/doc/unhide/ -rw-r--r-- root/root 1736 2013-04-28 21:44 ./usr/share/doc/unhide/changelog.Debian.gz -rw-r--r-- root/root 1388 2013-02-15 18:40 ./usr/share/doc/unhide/copyright -rw-r--r-- root/root 676 2013-02-15 18:40 ./usr/share/doc/unhide/README.Debian -rw-r--r-- root/root 2065 2012-10-07 17:35 ./usr/share/doc/unhide/README.txt.gz -rw-r--r-- root/root 1040 2010-11-14 16:15 ./usr/share/doc/unhide/TODO drwxr-xr-x root/root 0 2013-04-28 21:44 ./usr/share/lintian/ drwxr-xr-x root/root 0 2013-04-28 21:44 ./usr/share/lintian/overrides/ -rw-r--r-- root/root 359 2013-02-15 18:40 ./usr/share/lintian/overrides/unhide drwxr-xr-x root/root 0 2013-04-28 21:44 ./usr/sbin/ -rwxr-xr-x root/root 398356 2013-04-28 21:44 ./usr/sbin/unhide-tcp -rwxr-xr-x root/root 389600 2013-04-28 21:44 ./usr/sbin/unhide_rb -rwxr-xr-x root/root 434872 2013-04-28 21:44 ./usr/sbin/unhide-linux -rwxr-xr-x root/root 385464 2013-04-28 21:44 ./usr/sbin/unhide-posix lrwxrwxrwx root/root 0 2013-04-28 21:44 ./usr/bin/unhide -> ../sbin/unhide-linux lrwxrwxrwx root/root 0 2013-04-28 21:44 ./usr/share/man/man8/unhide-linux.8.gz -> unhide.8.gz lrwxrwxrwx root/root 0 2013-04-28 21:44 ./usr/share/man/man8/unhide-posix.8.gz -> unhide.8.gz unhide_20121229-1_armhf.changes: Format: 1.8 Date: Fri, 15 Feb 2013 19:14:05 +0100 Source: unhide Binary: unhide Architecture: armhf Version: 20121229-1 Distribution: saucy-proposed Urgency: low Maintainer: Ubuntu/armhf Build Daemon Changed-By: Julien Valroff Description: unhide - Forensic tool to find hidden processes and ports Changes: unhide (20121229-1) unstable; urgency=low . * New upstream release * Add unhide_rb and unhide-posix to the package Checksums-Sha1: a929491aee6546987933ec562612b3831fcaf1ad 986568 unhide_20121229-1_armhf.deb Checksums-Sha256: e6b605fa2cf442eab7e69898e6c4a535a217963d7fc9712c33017aebfc96e303 986568 unhide_20121229-1_armhf.deb Files: c5a81bdcc3c967ecc5fb0e86d0afcdf6 986568 admin extra unhide_20121229-1_armhf.deb ****************************************************************************** Built successfully ****************************************************************************** Finished at 20130428-2144 Build needed 00:01:04, 5316k disk space RUN: /usr/share/launchpad-buildd/slavebin/scan-for-processes ['/usr/share/launchpad-buildd/slavebin/scan-for-processes', 'b8a69cb8429c6fdffe2a7919f17981bbff9b2573'] Scanning for processes to kill in build /home/buildd/build-b8a69cb8429c6fdffe2a7919f17981bbff9b2573/chroot-autobuild... RUN: /usr/share/launchpad-buildd/slavebin/umount-chroot ['umount-chroot', 'b8a69cb8429c6fdffe2a7919f17981bbff9b2573'] Unmounting chroot for build b8a69cb8429c6fdffe2a7919f17981bbff9b2573... RUN: /usr/share/launchpad-buildd/slavebin/remove-build ['remove-build', 'b8a69cb8429c6fdffe2a7919f17981bbff9b2573'] Removing build b8a69cb8429c6fdffe2a7919f17981bbff9b2573