chkrootkit strange report

[Ric Moore]

Again, I get this note in the report

Searching for anomalies in shell history files... Warning: `' is linked
to another file

Does anyone have a clue how to find this file?? Is `' a filename or a
directory and what command line would I use to list/expose it??

Thanks, Ric

[Michael Schwendt]

On Mon, 11 Feb 2008 18:58:08 -0500, Ric Moore wrote:
> Again, I get this note in the report
>
> Searching for anomalies in shell history files... Warning: `' is linked
> to another file
>
> Does anyone have a clue how to find this file?? Is `' a filename or a
> directory and what command line would I use to list/expose it??

It's a bug. Apply attached patch to
/usr/lib/chkrootkit-0.48/chkrootkit to fix it.

[Ric Moore]

On Tue, 2008-02-12 at 10:13 +0100, Michael Schwendt wrote:
> On Mon, 11 Feb 2008 18:58:08 -0500, Ric Moore wrote:
> > Again, I get this note in the report
> >
> > Searching for anomalies in shell history files... Warning: `' is linked
> > to another file
> >
> > Does anyone have a clue how to find this file?? Is `' a filename or a
> > directory and what command line would I use to list/expose it??
>
> It's a bug. Apply attached patch to
> /usr/lib/chkrootkit-0.48/chkrootkit to fix it.

I hate to appear stupid, but how do I apply that? I thought patching was
done to tar files or src rpms? Please give my old head some education.
Thanks again! Ric

[Todd Zullinger]

Ric Moore wrote:
> > It's a bug. Apply attached patch to
> > /usr/lib/chkrootkit-0.48/chkrootkit to fix it.
>
> I hate to appear stupid, but how do I apply that? I thought patching
> was done to tar files or src rpms? Please give my old head some
> education.

Patches are generally applied using the patch command.  It takes the
output of diff and applies it to the files named in the diff.  For the
patch that Michael sent, you should be able to apply it like so:

# cd /usr/lib/chkrootkit-0.48
# patch -p1 -b < /path/to/where/you/saved/the/patch-file

That should apply the patch and backup the chkrootkit file (as
chkrootkit~).  The -p1 tells patch to strip off the first directory
level of the path in the patch file.  So it would remove the
chkrootkit-0.48-orig/ and chkrootkit-0.48/ parts and use chkrootkit as
the filename to which it's applying the patch.

Or you could grab an (unsigned) rpm out of koji:

F8: http://koji.fedoraproject.org/koji/buildinfo?buildID=35724
F7: http://koji.fedoraproject.org/koji/buildinfo?buildID=35723

Or you could wait a day or so for it to show up via a regular yum
update. ;)

[Ric Moore]

On Wed, 2008-02-13 at 02:48 -0500, Todd Zullinger wrote:
> Ric Moore wrote:
> > > It's a bug. Apply attached patch to
> > > /usr/lib/chkrootkit-0.48/chkrootkit to fix it.
> >
> > I hate to appear stupid, but how do I apply that? I thought patching
> > was done to tar files or src rpms? Please give my old head some
> > education.
>
> Patches are generally applied using the patch command.  It takes the
> output of diff and applies it to the files named in the diff.  For the
> patch that Michael sent, you should be able to apply it like so:
>
> # cd /usr/lib/chkrootkit-0.48
> # patch -p1 -b < /path/to/where/you/saved/the/patch-file
>
> That should apply the patch and backup the chkrootkit file (as
> chkrootkit~).  The -p1 tells patch to strip off the first directory
> level of the path in the patch file.  So it would remove the
> chkrootkit-0.48-orig/ and chkrootkit-0.48/ parts and use chkrootkit as
> the filename to which it's applying the patch.
>
> Or you could grab an (unsigned) rpm out of koji:
>
> F8: http://koji.fedoraproject.org/koji/buildinfo?buildID=35724
> F7: http://koji.fedoraproject.org/koji/buildinfo?buildID=35723
>
> Or you could wait a day or so for it to show up via a regular yum
> update. ;)

Thanks, I sorta knew how "patch" has been used in the past to change the
innards of a tar file, I was just hesitant to use it towards a script
already applied. Thanks be to the strong efforts of others, I have never
had to, in a bunch of years! My gratitude goes to the efforts of the
Devel teams.

Humans make mistakes 15% of the time, statistically. So, the occasional
burp in the barrel is to be expected and I'm delighted that there are as
few hiccups as we've seen. I would insert one caveat, if it ain't broke
don't fix it, as that 15% chance comes back into play. :) Ric