F17 rkhunter /lib/java False Positive?

[Frank Murphy]

16:46:00] Warning: Checking for possible rootkit files and directories [ 
Warning ]
[16:46:00]          Found directory '/lib/java'. Possible rootkit: 
Rootkit component

rkhunter-1.3.8-14.fc17.noarch

As /lib/java is empty, guessing false positive.

Is it worth filing a bz.

[Deepak Bhole]

* Frank Murphy  [2012-03-26 12:00]:
> 16:46:00] Warning: Checking for possible rootkit files and
> directories [ Warning ]
> [16:46:00]          Found directory '/lib/java'. Possible rootkit:
> Rootkit component
>
> rkhunter-1.3.8-14.fc17.noarch
>
> As /lib/java is empty, guessing false positive.
>
> Is it worth filing a bz.

Bug against rkhunter or the Java (OpenJDK) package? AFAIK none of the
OpenJDK packages create /lib/java . Might be worth looking into what
does (rpm -qf).

Cheers,
Deepak
> -- 
> Regards,
> Frank
> "Jack of all, fubars"
> -- 
> test mailing list
> [e-mail]
> To unsubscribe:
> https://admin.fedoraproject.org/mailman/listinfo/test

[Frank Murphy]

On 26/03/12 17:03, Deepak Bhole wrote:
> Bug against rkhunter or the Java (OpenJDK) package? AFAIK none of the
> OpenJDK packages create /lib/java . Might be worth looking into what
> does (rpm -qf).

rpm -qf /lib/java
jpackage-utils-1.7.5-16.fc17.i686

[Deepak Bhole]

* Frank Murphy  [2012-03-26 12:13]:
> On 26/03/12 17:03, Deepak Bhole wrote:
> > Bug against rkhunter or the Java (OpenJDK) package? AFAIK none of the
> > OpenJDK packages create /lib/java . Might be worth looking into what
> > does (rpm -qf).
>
> rpm -qf /lib/java
> jpackage-utils-1.7.5-16.fc17.i686

Weird. It is not on my system. Not listed here either:
http://koji.fedoraproject.org/koji/rpminfo?rpmID=2879224

Deepak
> -- 
> Regards,
> Frank
> "Jack of all, fubars"
> -- 
> test mailing list
> [e-mail]
> To unsubscribe:
> https://admin.fedoraproject.org/mailman/listinfo/test

[Michael Schwendt]

On Mon, 26 Mar 2012 12:18:38 -0400, DB (Deepak) wrote:
> Frank Murphy <frankly3d> [2012-03-26 12:13]:
> > On 26/03/12 17:03, Deepak Bhole wrote:
> > > Bug against rkhunter or the Java (OpenJDK) package? AFAIK none of the
> > > OpenJDK packages create /lib/java . Might be worth looking into what
> > > does (rpm -qf).
> >
> > rpm -qf /lib/java
> > jpackage-utils-1.7.5-16.fc17.i686
>
> Weird. It is not on my system. Not listed here either:
> http://koji.fedoraproject.org/koji/rpminfo?rpmID=2879224

Don't forget that with F-17 there is a symlink from /lib -> /usr/lib,
and the package certainly includes %_libdir/java/

[Deepak Bhole]

* Michael Schwendt  [2012-03-26 12:29]:
> On Mon, 26 Mar 2012 12:18:38 -0400, DB (Deepak) wrote:
> > Frank Murphy <frankly3d> [2012-03-26 12:13]:
> > > On 26/03/12 17:03, Deepak Bhole wrote:
> > > > Bug against rkhunter or the Java (OpenJDK) package? AFAIK none of the
> > > > OpenJDK packages create /lib/java . Might be worth looking into what
> > > > does (rpm -qf).
> > >
> > > rpm -qf /lib/java
> > > jpackage-utils-1.7.5-16.fc17.i686
> >
> > Weird. It is not on my system. Not listed here either:
> > http://koji.fedoraproject.org/koji/rpminfo?rpmID=2879224
>
> Don't forget that with F-17 there is a symlink from /lib -> /usr/lib,
> and the package certainly includes %_libdir/java/

Ah! Sorry, I didn't know about that change.

Cheers,
Deepak
> -- 
> Fedora release 16 (Verne) - Linux 3.3.0-4.fc16.x86_64
> loadavg: 0.01 0.02 0.05
> -- 
> test mailing list
> [e-mail]
> To unsubscribe:
> https://admin.fedoraproject.org/mailman/listinfo/test

[Frank Murphy]

On 26/03/12 17:18, Deepak Bhole wrote:
> Weird. It is not on my system. Not listed here either:
> http://koji.fedoraproject.org/koji/rpminfo?rpmID=2879224

it is as /lib is now /usr/lib since convertfs

filed bz against rkh
https://bugzilla.redhat.com/show_bug.cgi?id=806972