Re: chkrootkit output
- From: Alan Cox <alan@xxxxxxxxxxxxxxxxxxx>
- Date: Tue, 8 May 2012 16:54:47 +0100
On Tue, 08 May 2012 10:46:13 -0600
JD <jd1008@xxxxxxxxx> wrote:
Searching for Suckit rootkit... Warning: /sbin/init INFECTED
lrwxrwxrwx 1 root root 14 May 8 10:19 /sbin/init -> ../bin/systemd
rwxr-x-r-x 1 root root 917320 Apr 17 01:50 /bin/systemd
$ sha256sum /bin/systemd
73054e573603f8894c6df2078b7714f7533d5b95653b536e7f07d2c8f3f09bc1
/bin/systemd
Is chkrootkit confused?
Yes and no. It correctly detects that your /sbin/init is something hideous
and nasty, but fails to realise that it's something hideous and nasty that
Fedora ships 8)
In all seriousness its a bug in chkrootkit, which has been reported
repeatedly and ignored repeatedly. It treats the linked /sbin/init as
suspicious because some rootkits did exactly that.
Alan
--
users mailing list
users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
- Follow-Ups:
- Re: chkrootkit output
- From: Bill Davidsen
- Re: chkrootkit output
- References:
- chkrootkit output
- From: JD
- chkrootkit output
- Prev by Date: Re: chkrootkit output
- Next by Date: Re: Fedora 18 release name
- Previous by thread: Re: chkrootkit output
- Next by thread: Re: chkrootkit output
- Index(es):
Relevant Pages
|
