(f-40, stand-alone workstation, gnome)
A few times in the past couple of months, I've received the following warning from "chkrootkit": - - - - - - bash.1[~]: chkrootkit ROOTDIR is `/' Checking `amd'... not found [snip] Checking `bindshell'... not infected Checking `lkm'... You have 1 process hidden for ps command chkproc: Warning: Possible LKM Trojan installed chkdirs: nothing detected Checking `rexedcs'... not found [snip] Checking `OSX_RSPLUG'... not tested bash.2[~]: - - - - - - Leading and trailing lines are merely context. "rkhunter" gives no warnings.
What's going on with that lkm warning?
On Thu, Nov 28, 2024 at 12:25 PM home user via users users@lists.fedoraproject.org wrote:
(f-40, stand-alone workstation, gnome)
A few times in the past couple of months, I've received the following warning from "chkrootkit":
bash.1[~]: chkrootkit ROOTDIR is `/' Checking `amd'... not found [snip] Checking `bindshell'... not infected Checking `lkm'... You have 1 process hidden for ps command chkproc: Warning: Possible LKM Trojan installed chkdirs: nothing detected Checking `rexedcs'... not found [snip] Checking `OSX_RSPLUG'... not tested bash.2[~]:
Leading and trailing lines are merely context. "rkhunter" gives no warnings.
What's going on with that lkm warning?
Do you really need us to google it for you?
On 29/11/24 04:37, Jeffrey Walton wrote:
On Thu, Nov 28, 2024 at 12:25 PM home user via users users@lists.fedoraproject.org wrote:
(f-40, stand-alone workstation, gnome)
A few times in the past couple of months, I've received the following warning from "chkrootkit":
bash.1[~]: chkrootkit ROOTDIR is `/' Checking `amd'... not found [snip] Checking `bindshell'... not infected Checking `lkm'... You have 1 process hidden for ps command chkproc: Warning: Possible LKM Trojan installed chkdirs: nothing detected Checking `rexedcs'... not found [snip] Checking `OSX_RSPLUG'... not tested bash.2[~]:
Leading and trailing lines are merely context. "rkhunter" gives no warnings.
What's going on with that lkm warning?
Do you really need us to google it for you?
I've run chkrootkit and it said there were no issues, but rkhunter has reported two suspect files, being /usr/bin/egrep and /usr/bin/fgrep because it has said they have been replaced by a script, is that standard Fedora?
regards, Steve
On Fri, 2024-11-29 at 09:45 +1100, Stephen Morris wrote:
I've run chkrootkit and it said there were no issues, but rkhunter has reported two suspect files, being /usr/bin/egrep and /usr/bin/fgrep because it has said they have been replaced by a script, is that standard Fedora?
fgrep and egrep were both deprecated some time ago. Grep subsumes the functionality of both. Run 'type fgrep' or 'type egrep' and they will show that both are now simply aliases.
poc
On 28 Nov 2024, at 22:45, Stephen Morris steve.morris.au@gmail.com wrote:
being /usr/bin/egrep and /usr/bin/fgrep because it has said they have been replaced by a script, is that standard Fedora?
Did you check what was in the files and where they were installed from?
The scripts print a warning message then run grep.
$ cat /usr/bin/fgrep #!/usr/bin/sh cmd=${0##*/} echo "$cmd: warning: $cmd is obsolescent; using grep -F" >&2 exec grep -F "$@"
At some point the scripts will be dropped.
It is by design.
Barry
On Thu, 28 Nov 2024 at 17:38, Jeffrey Walton noloader@gmail.com wrote:
On Thu, Nov 28, 2024 at 12:25 PM home user via users users@lists.fedoraproject.org wrote:
Checking `lkm'... You have 1 process hidden for ps command
What's going on with that lkm warning?
Do you really need us to google it for you?
And what Jeffery's referring to here is pretty much the first response if you Google/DDG[1]
"Checking `lkm'... You have 1 process hidden for ps command"
https://askubuntu.com/a/587903
Knowing what to search on, and then how to quickly drill down to something relevant, is a skill, one worth developing.
The list guidelines[2] include this presentation[3] which references this age-old FAQ[4], which, regardless of what you think of ESR, is a worthwhile read.
[1] https://duckduckgo.com/?t=ffab&q=Checking+%60lkm%27...+You+have+1+proces... [2] https://fedoraproject.org/wiki/Mailing_list_guidelines [3] http://www.shakthimaan.com/downloads/glv/presentations/mailing-list-etiquett... [4] http://www.catb.org/~esr/faqs/smart-questions.html#before
On 11/28/24 10:24 AM, home user via users wrote:
(f-40, stand-alone workstation, gnome)
A few times in the past couple of months, I've received the following warning from "chkrootkit":
bash.1[~]: chkrootkit ROOTDIR is `/' Checking `amd'... not found [snip] Checking `bindshell'... not infected Checking `lkm'... You have 1 process hidden for ps command chkproc: Warning: Possible LKM Trojan installed chkdirs: nothing detected Checking `rexedcs'... not found [snip] Checking `OSX_RSPLUG'... not tested bash.2[~]:
Leading and trailing lines are merely context. "rkhunter" gives no warnings.
What's going on with that lkm warning?
(general reply)
The google search results I saw were for ubantu and other "flavors" of Linux, but I did not notice anything for Fedora. (but I could easily have missed something)
The google search results I saw were from nearly a decade ago and older. But when I did "dnf history chkrootkit" before opening this thread (and now), I saw (and still see) this: 1537 | upgrade | 2023-12-21 10:56 | C, E, I, O, U | 239 >< So it seems to me that chkrootkit is still being maintained. wikipedia confirmed, both before opening this thread, and now. Yet them google search results, even from more than a decade ago, said that what I reported is a known problem with chkrootkit. After more than a decade, it ain't fixed?!
Before opening this thread (and now), chkrootkit has no man page. I saw nothing helpful in chkrootkit -help (or -h) before opening this thread (and now).
When it comes to Fedora and Linux matters, I much prefer to trust, and much more trust, the expert, professional, very experienced helpers in this list over google or any other internet search engine (or "AI"). This list's help is likely to be current and specific.
I gather from two thread responses that what I got was a false alarm.
On Fri, 29 Nov 2024 at 18:20, home user via users < users@lists.fedoraproject.org> wrote:
On 11/28/24 10:24 AM, home user via users wrote:
(f-40, stand-alone workstation, gnome)
A few times in the past couple of months, I've received the following
warning from "chkrootkit":
Checking `lkm'... You have 1 process hidden for ps command chkproc: Warning: Possible LKM Trojan installed What's going on with that lkm warning?
The google search results I saw were for ubantu and other "flavors" of Linux, but I did not notice anything for Fedora. (but I could easily have missed something)
There's a lot of commonality across most distros, so while something (the link I referenced, for example) was from an Ask Ubuntu branch of Stackexchange, a lot of the advice in it is still applicable.
Some minor implementation details may differ (package format obviously, maybe default configs) but a DEB chkrootkit is probably *very* close to an RPM packaged equivalent in both currency and behaviour.
You can even quickly compare/contrast some of this in Vagrant boxes or quickly spun up containers. I try to keep a bunch to hand for stuff just like this (https://github.com/wmcdonald404/wmcdonald404-vagrantfiles).
The google search results I saw were from nearly a decade ago and older. But when I did "dnf history chkrootkit" before opening this thread (and now), I saw (and still see) this: 1537 | upgrade | 2023-12-21 10:56 | C, E, I, O, U | 239 >< So it seems to me that chkrootkit is still being maintained. wikipedia confirmed, both before opening this thread, and now.
If you've Googled / searched something, it's always worth letting people know that. Compare:
1. "I run this thing and get this result, what's going on?" 2. "I run this thing and get this result. I've Googled and read [X] and [Y], I *think* this [Z] might be what's happening but I'm not entirely sure?"
I always used to say to people who come to me with problems at work, write it down. If I ask 'have you checked logs" (for example), and they have but haven't a) said so in their written summary and b) haven't included what they found, or that there was nothing there, then that's being slightly selfish with other people's time.
I mean obviously sometimes you just need an immediate 2nd opinion, but taking a logical, structured approach to analysing and describing a problem will, IME, lead you to self-resolution 9 times out of 10. Bonus side effect, if you don't nail it, you have a fabulous problem description for others to help you with.
Yet them google search results, even from more than a decade ago, said that
what I reported is a known problem with chkrootkit. After more than a decade, it ain't fixed?!
If you go read the Ubuntu thread, have you checked some of the advice to narrow down whether it is a false positive or not? Specifically these lines:
No, it is a false positive and a long standing bug in chrootkit. You will see the message any time the lkm check reports hidden processes inaccessible by the readdir command. If you have something like ClamAV, MySQL, Exim or MailScanner running you are bound to see this warning.
Easiest check: run chrootkit a couple of times with as many services stopped (ie. mysql, clamav etc). If the results vary it is a clear indicator it is a false positive.
Before opening this thread (and now), chkrootkit has no man page. I saw nothing helpful in chkrootkit -help (or -h) before opening this thread (and now).
Again, worth telling people "I've RTFMed and this is what I think, can someone confirm" or "I've tried to RTFM, there isn't one."
When it comes to Fedora and Linux matters, I much prefer to trust, and much more trust, the expert, professional, very experienced helpers in this list over google or any other internet search engine (or "AI"). This list's help is likely to be current and specific.
100%, but I (almost) always like to do (and demonstrate) legwork first personally. :) It's really just helping people help you, if that makes sense?
On Fri, Nov 29, 2024 at 3:09 PM Will McDonald wmcdonald@gmail.com wrote:
On Fri, 29 Nov 2024 at 18:20, home user via users < users@lists.fedoraproject.org> wrote: There's a lot of commonality across most distros, so while something (the link I referenced, for example) was from an Ask Ubuntu branch of Stackexchange, a lot of the advice in it is still applicable.
It helps to understand where distros differ. Package management differs, including policies for what gets packaged, and (where there are viable alternatives), which is installed and configured, accounts for many differences. For example: SElinux is available in Debian, but the default iis AppArmor.
arch linux often has excellent documentation
[...]
When it comes to Fedora and Linux matters, I much prefer to trust, and much more trust, the expert, professional,
very experienced helpers in this list over google or any other internet
search engine (or "AI"). This list's help is
likely to be current and specific.
100%, but I (almost) always like to do (and demonstrate) legwork first personally. :) It's really just helping people help you, if that makes sense?
Expert, professional, very experienced helpers are a scarce resource. The linux community benefits if other users do as much as they can on their own. The internet is full of "quick fixes" to common linux problems. Some are correct but a growing fraction are AI clickbait nonsense. Use man pages and documents from distros and kernel.org to make sure you understand what suggested solutions actually do.
Helping people help you may promote you from a user needing help to an expert, professional, very experienced helper.
On Fri, 29 Nov 2024 at 20:01, George N. White III gnwiii@gmail.com wrote:
On Fri, Nov 29, 2024 at 3:09 PM Will McDonald wmcdonald@gmail.com wrote:
On Fri, 29 Nov 2024 at 18:20, home user via users < users@lists.fedoraproject.org> wrote: There's a lot of commonality across most distros, so while something (the link I referenced, for example) was from an Ask Ubuntu branch of Stackexchange, a lot of the advice in it is still applicable.
It helps to understand where distros differ. Package management differs, including policies for what gets packaged, and (where there are viable alternatives), which is installed and configured, accounts for many differences. For example: SElinux is available in Debian, but the default iis AppArmor.
Indeed. I've jumped between RH-based and Debian-based distros a little in the last few years. I started tracking some of the deltas here: https://github.com/wmcdonald404/distrosetta-stone
Basic package management stuff because it's not muscle-memory like it used to be. PRs welcome ;-) (I have a domain reg-ed for this too if there's any desire to turn it into something more comprehensive.)
On Fri, 2024-11-29 at 20:37 +0000, Will McDonald wrote:
Indeed. I've jumped between RH-based and Debian-based distros a little in the last few years. I started tracking some of the deltas here: https://github.com/wmcdonald404/distrosetta-stone
You might want to change the yum references to dnf, which has been the standard in Fedora for a good few years now. In recent releases, /usr/bin/yum is just a symlink (to dnf5 in F41).
poc
On 29/11/24 10:59, Barry wrote:
On 28 Nov 2024, at 22:45, Stephen Morrissteve.morris.au@gmail.com wrote:
being /usr/bin/egrep and /usr/bin/fgrep because it has said they have been replaced by a script, is that standard Fedora?
Did you check what was in the files and where they were installed from?
The scripts print a warning message then run grep.
$ cat /usr/bin/fgrep #!/usr/bin/sh cmd=${0##*/} echo "$cmd: warning: $cmd is obsolescent; using grep -F" >&2 exec grep -F "$@"
At some point the scripts will be dropped.
It is by design.
Barry
Thanks Barry, I checked both of them and they are both what you have shown.
regards, Steve
-
Barry -
George N. White III -
home user -
Jeffrey Walton -
Patrick O'Callaghan -
Stephen Morris -
Will McDonald