Just noticed strange thing in rkhunter report.

[Michael D. Setzer II]

Gives a warning about gawk in /usr/libexec??

In /usr/libexec awk is a directory with two files versus a 
file??

ls -l | grep awk
drwxr-xr-x. 2 root root                   4096 Jun  6 16:36 awk
lrwxrwxrwx. 1 root root                      3 Sep 18 01:19 gawk -> awk

# ls awk -l
total 32
-rwxr-xr-x. 1 root root 15944 Jul 22  2021 grcat
-rwxr-xr-x. 1 root root 15928 Jul 22  2021 pwcat

Looks like the link of gawk -> awk is recent 9/18, but awk 
being a directory goes back to June, and files in it go back 
to Jul 2021??

Is this normal or is something off.
Looked at 5 machines I have with Fedora 35 at home, and 
all have the same files and dates.

Thanks. Sure someone knows.

+------------------------------------------------------------+
 Michael D. Setzer II - Computer Science Instructor 
(Retired)     
 mailto:[e-mail]                            
 mailto:[e-mail]
 Guam - Where America's Day Begins                        
 G4L Disk Imaging Project maintainer 
 http://sourceforge.net/projects/g4l/
+------------------------------------------------------------+

[John Horne]

On Fri, 2022-09-30 at 04:34 +1000, Michael D. Setzer II via users wrote:
>  Gives a warning about gawk in /usr/libexec??
>
>  
What warning?


John.

--
John Horne | Senior Operations Analyst | Technology and Information Services
University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK
________________________________
[http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth...

This email and any files with it are confidential and intended solely for the use of the
recipient to whom it is addressed. If you are not the intended recipient then copying,
distribution or other use of the information contained is strictly prohibited and you
should not rely on it. If you have received this email in error please let the sender know
immediately and delete it from your system(s). Internet emails are not necessarily secure.
While we take every care, University of Plymouth accepts no responsibility for viruses and
it is your responsibility to scan emails and their attachments. University of Plymouth
does not accept responsibility for any changes made after it was sent. Nothing in this
email or its attachments constitutes an order for goods or services unless accompanied by
an official order form.

[Michael D. Setzer II]

On 30 Sep 2022 at 0:23, John Horne wrote:

From:           	John Horne <john.horne(a)plymouth.ac.uk&gt;
To:             	&quot;users(a)lists.fedoraproject.org&quot; 
<users(a)lists.fedoraproject.org&gt;
Subject:        	Re: Just noticed strange thing in rkhunter 
report.
Date sent:      	Fri, 30 Sep 2022 00:23:58 +0000
Send reply to:  	Community support for Fedora 
users <users(a)lists.fedoraproject.org&gt;

>  On Fri, 2022-09-30 at 04:34 +1000, Michael D. Setzer II via users
> wrote:
>  > Gives a warning about gawk in /usr/libexec??
>  >
>  What warning? 
[04:18:49]   /usr/libexec/gawk                               [ Warning ]
[04:18:49] Warning: Package manager verification has failed:
[04:18:49]          File: /usr/libexec/gawk
[04:18:49]          The symbolic link target has changed

Saw that link was point to directory and not a file, but the 
message from rkhunter.log. Not sure if that meant the 
link pointed to something different in the past.

drwxr-xr-x. 2 root root                   4096 Jun  6 16:36 awk
lrwxrwxrwx. 1 root root                      3 Sep 18 01:19 gawk -> awk




>  
>  
>  John.
>  
>  --
>  John Horne | Senior Operations Analyst | Technology and Information Services
>  University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK
>  ________________________________
>
> [http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth...
>  
>  This email and any files with it are confidential and intended solely for the use of the
> recipient to whom it is addressed. If you are not the intended recipient then copying,
> distribution or other use of the information contained is strictly prohibited and you
> should not rely on it. If you have received this email in error please let the sender know
> immediately and delete it from your system(s). Internet emails are not necessarily secure.
> While we take every care, University of Plymouth accepts no responsibility for viruses and
> it is your responsibility to scan emails and their attachments. University of Plymouth
> does not accept responsibility for any changes made after it was sent. Nothing in this
> email or its attachments constitutes an order for goods or services unless accompanied by
> an official order form.
>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

+------------------------------------------------------------+
 Michael D. Setzer II - Computer Science Instructor 
(Retired)     
 mailto:[e-mail]                            
 mailto:[e-mail]
 Guam - Where America's Day Begins                        
 G4L Disk Imaging Project maintainer 
 http://sourceforge.net/projects/g4l/
+------------------------------------------------------------+

[John Horne]

On Fri, 2022-09-30 at 14:05 +1000, Michael D. Setzer II via users wrote:
>  [04:18:49]   /usr/libexec/gawk                               [ Warning ]
>  [04:18:49] Warning: Package manager verification has failed:
>  [04:18:49]          File: /usr/libexec/gawk
>  [04:18:49]          The symbolic link target has changed
>
>  
Okay, so it is saying that the RPM package manager cannot verify the package
(gawk) that contains the /usr/libexec/gawk file. The reason being because the
link target is not what the package expects.

If you run something like 'rpm -V gawk' you'll probably see an 'L' in
there for
the /usr/libexec/gawk file.

What is should point to I could not say. You may be able to find out by looking
in the '/var/lib/rkhunter/db/rkhunter.dat' file and the '.old' file, but
that
will only work if you haven't run RKH with '--propupd' since the warning.
(On F36, it points to /usr/libexec/awk rather than just 'awk')


John.

--
John Horne | Senior Operations Analyst | Technology and Information Services
University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK
________________________________
[http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth...

This email and any files with it are confidential and intended solely for the use of the
recipient to whom it is addressed. If you are not the intended recipient then copying,
distribution or other use of the information contained is strictly prohibited and you
should not rely on it. If you have received this email in error please let the sender know
immediately and delete it from your system(s). Internet emails are not necessarily secure.
While we take every care, University of Plymouth accepts no responsibility for viruses and
it is your responsibility to scan emails and their attachments. University of Plymouth
does not accept responsibility for any changes made after it was sent. Nothing in this
email or its attachments constitutes an order for goods or services unless accompanied by
an official order form.

[Todd Zullinger]

John Horne wrote:
>  On Fri, 2022-09-30 at 14:05 +1000, Michael D. Setzer II via users
> wrote:
> >
> > [04:18:49]   /usr/libexec/gawk                               [ Warning ]
> > [04:18:49] Warning: Package manager verification has failed:
> > [04:18:49]          File: /usr/libexec/gawk
> > [04:18:49]          The symbolic link target has changed
> >
>  Okay, so it is saying that the RPM package manager cannot verify the package
>  (gawk) that contains the /usr/libexec/gawk file. The reason being because the
>  link target is not what the package expects.
>  
>  If you run something like 'rpm -V gawk' you'll probably see an 'L' in
> there for
>  the /usr/libexec/gawk file.
>  
>  What is should point to I could not say. 
$ rpm -q gawk ; rpm -qlv gawk | grep /usr/libexec/gawk | sed -E 's/ +/ /g'
gawk-5.1.0-4.fc35.x86_64
lrwxrwxrwx 1 root root 16 Jul 21 2021 /usr/libexec/gawk -> /usr/libexec/awk

(sed is only used to reduce the line width for email)

This seems like fallout from the badlinks thread here which
started on 9/16. :)

-- 
Todd