Another rkhunter question
Paulo Cavalcanti
promac at gmail.com
Sun May 17 15:05:46 UTC 2009
On Sun, May 17, 2009 at 10:35 AM, Gene Heskett <gene.heskett at verizon.net>wrote:
> Greetings all;
>
> What is /dev/shm?
>
> I've given up on rkhunter ever shutting up about the group and passwd
> files,
> but fussing about this is new.
> ---------------------- Start Rootkit Hunter Scan ----------------------
> Warning: Suspicious file types found in /dev:
> /dev/shm/sem.ADBE_REL_root: data
> /dev/shm/sem.ADBE_WritePrefs_root: data
> /dev/shm/sem.ADBE_ReadPrefs_root: data
>
> And indeed, these files that I nuked friday are back:
> [root at coyote linux-2.6.30-rc6]# ls -l /dev/shm
> total 24
> -r-------- 1 root root 67108904 2009-05-16 02:37 pulse-shm-3724332759
> -rw-rw-rw- 1 root root 16 2009-05-16 20:33 sem.ADBE_ReadPrefs_root
> -rw-rw-rw- 1 root root 16 2009-05-16 20:33 sem.ADBE_REL_root
> -rw-rw-rw- 1 root root 16 2009-05-16 20:33 sem.ADBE_WritePrefs_root
>
> Anything with 'pulse' in its name has been nuked by an 'rpm -e', and I
You should have not, but it is your choice.
>
> actually have working audio now, so can someone please explain this? A 67
> megabyte file in /dev for an shm device is for what purpose?
>
> I looked at it with mc's hex viewer, and the first 10 or so megabytes are
> all
> $00. I got tired of standing on the page down key.
>
>
Just add these rules to /etc/rkhunter.conf, in the appropriate place:
# Allow the specified files to be present in the /dev directory,
# and not regarded as suspicious. One file per line (use multiple
# ALLOWDEVFILE lines).
#
#ALLOWDEVFILE=/dev/abc
#ALLOWDEVFILE=/dev/shm/pulse-shm-*
# Adobe Reader (acroread) 9.x
ALLOWDEVFILE=/dev/shm/sem.ADBE_ReadPrefs_[a-zA-Z]*
ALLOWDEVFILE=/dev/shm/sem.ADBE_REL_[a-zA-Z]*
ALLOWDEVFILE=/dev/shm/sem.ADBE_WritePrefs_[a-zA-Z]*
--
Paulo Roma Cavalcanti
LCG - UFRJ
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20090517/429dbe1f/attachment-0001.htm>
More information about the fedora-list
mailing list