File: check_if_debian.patch

package info (click to toggle)
chkrootkit 0.58b-5
  • links: PTS, VCS
  • area: main
  • in suites: forky, sid, trixie
  • size: 7,796 kB
  • sloc: sh: 187,095; ansic: 3,779; makefile: 103
file content (58 lines) | stat: -rw-r--r-- 1,872 bytes parent folder | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
From: Richard Lewis <richard.lewis.debian@googlemail.com>
Date: Wed, 14 Aug 2024 18:24:14 +0100
Subject: check_if_debian

New helper to check whether reported files are from Debian packahes,
using dpkg-query This is safe to use on non-Debian systems (it will do
nothing unless dpkg-query is found)

Forwarded: yes
(Forwarded by email: 21 Dec 2024)
---
 check_if_debian | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100755 check_if_debian

diff --git a/check_if_debian b/check_if_debian
new file mode 100755
index 0000000..c8717fe
--- /dev/null
+++ b/check_if_debian
@@ -0,0 +1,37 @@
+#!/bin/sh
+
+#usage:  file/to/check [/path/tp/dpkg-query [mode]]
+# see if $1 was installed by dpkg
+dpkg_query="${2-/usr/bin/dpkg-query}"
+mode="${3-rt}"
+if [ ! -x "${dpkg_query}" ] || [ "${mode}" = "pm" ]; then
+	# not Debian or using -r
+	echo "$1"
+	exit 0
+fi
+file_to_report="/${1#/}" # ensure 1 leading '/'
+
+package=$("${dpkg_query}" --search -- "$file_to_report" 2>/dev/null)
+if [ -z "$package" ]; then
+	# dpkg-query does not understand usrmerge
+	case "$file_to_report" in
+		# dirs which become symlinks (see /usr/lib/usrmerge/convert-usrmerge)
+		/bin/*|/sbin/*|/lib/*|/lib64/*|/lib32/*|/libo32/*|/libx32/*)
+			# /bin/apt not found because /usr/bin/apt shipped
+			package=$("${dpkg_query}" --search -- "/usr$file_to_report" 2>/dev/null)
+			;;
+		/usr/bin/*|/usr/sbin/*|/usr/lib/*|/usr/lib64/*|/usr/lib32/*|/usr/libo32/*|/usr/libx32/*)
+			# /usr/bin/bash not found because /bin/bash shipped
+			package=$("${dpkg_query}" --search -- "${file_to_report#/usr}" 2>/dev/null)
+			;;
+	esac
+fi
+if [ -n "$package" ]; then
+	# package is <package>: /path/to/file
+	package="From Debian package: ${package%:*}"
+else
+	package="Not from a Debian package"
+fi
+# nb: $1 may be intentionally missing a /
+echo "$1 [$package]"
+exit 0