1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
From: Richard Lewis <richard.lewis.debian@googlemail.com>
Date: Wed, 16 Oct 2024 21:13:11 +0100
Subject: chkrootkit: z2
Improve z2 test. Skip chkproc if -r is given, since it checks /proc and running processes
Ensure chklastlog can work with -r: Do not add a second copy of ROOTDIR to $WTMP and $LASTLOG
Includes contributions from:
Author: lantz moore <lmoore@debian.org>
Date: Thu Oct 3 01:02:10 2002 -0400
Pass -q to chklastlog (and other cleanups)
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=142422
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=190978
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=229869
Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=306263
Forwarded: https://lists.debian.org/debian-security-tools/2021/10/msg00006.html
Forwarded: yes
(Forwarded by email: 21 Dec 2024)
---
chkrootkit | 24 +++++++++++++-----------
1 file changed, 13 insertions(+), 11 deletions(-)
diff --git a/chkrootkit b/chkrootkit
index 4473636..d0e3263 100755
--- a/chkrootkit
+++ b/chkrootkit
@@ -246,26 +246,28 @@ chkutmp() {
z2 () {
if [ ! -x ./chklastlog ]; then
- echo "not tested: can't exec ./chklastlog"
- return ${NOT_TESTED}
+ _warn "z2 not tested: can't exec ./chklastlog"
+ return "${NOT_TESTED}"
fi
- WTMP=`loc wtmp wtmp "${ROOTDIR}var/log ${ROOTDIR}var/adm"`
- LASTLOG=`loc lastlog lastlog "${ROOTDIR}var/log ${ROOTDIR}var/adm"`
+ WTMP=$(loc wtmp wtmp "${ROOTDIR}var/log ${ROOTDIR}var/adm")
+ LASTLOG=$(loc lastlog lastlog "${ROOTDIR}var/log ${ROOTDIR}var/adm")
- if [ ! -f $WTMP -a ! -f $LASTLOG ]; then
- echo "not tested: not found wtmp and/or lastlog file"
- return ${NOT_TESTED}
+ if [ ! -f "$WTMP" ] && [ ! -f "$LASTLOG" ]; then
+ _not_tested
+ return "${NOT_TESTED}"
fi
if [ "${EXPERT}" = "t" ]; then
- expertmode_output "./chklastlog -f ${ROOTDIR}${WTMP} -l ${ROOTDIR}${LASTLOG}"
+ expertmode_output "./chklastlog ${QUIET_ARG} -f ${ROOTDIR}${WTMP} -l ${ROOTDIR}${LASTLOG}"
return 5
fi
- if ./chklastlog -f ${ROOTDIR}${WTMP} -l ${ROOTDIR}${LASTLOG}
- then
- if [ "${QUIET}" != "t" ]; then echo "chklastlog: nothing deleted"; fi
+ outmsg=$(./chklastlog "${QUIET_ARG}" -f "${WTMP}" -l "${LASTLOG}" 2>&1)
+ if [ $? -eq 0 ]; then
+ _not_found
+ else
+ _warn "output from chklastlog:\n$outmsg\n"
fi
}
|
