Rootkit Hunter / Patches / #23 Allows read-only DBPATH

#23 Allows read-only DBPATH

Milestone: main

Status: closed-fixed

Owner: unSpawn

Labels: rkhunter (35)

Priority: 5

Updated: 2008-12-10

Created: 2008-08-01

Creator: Julien Valroff

Private: No

Hi,

Please find attached a patch allowing $DBPATH to be read-only (like on a non-writable removable media for more safety), except when running --propupd or --update.

Please can you review and confirm this has no other consequences? Plan is to add this patch ASAP to Debian in order to close Debian bug #48900 (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=489000)

Thanks
Cheers,
Julien

Discussion

Julien Valroff - 2008-08-01

dbpath_readonly.diff

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

unSpawn - 2008-08-01

milestone: --> main

assigned_to: nobody --> unspawn
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

unSpawn - 2008-08-01

Logged In: YES
user_id=600864
Originator: NO

Hello Julien,

Thanks for the patch, I've tested it against RKH CVS (1.3.3) with a --propupd and scan run without negative sideeffects. Please hold while I ask on the RKH dev list for feedback, I'm sure the OK will come RSN.

Best regards, unSpawn

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

unSpawn - 2008-08-03

Logged In: YES
user_id=600864
Originator: NO

Hello Julien,

John currently is reworking some things so I'm asking if you can hold until the 11th. Then everything related will be in CVS. Thanks.

BTW, totally unrelated[0], I saw a Japanese .po translation appear in your bug tracker (the swedish one was for old 1.2.7?). I'm wondering, being upstream, can we "just take" that (properly crediting the author of course)? Also unrelated[1], is there any way I could be automagically informed of new tickets added to "http://bugs.debian.org/cgi-bin/pkgreport.cgi?src=rkhunter"?

TIA, unSpawn

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Julien Valroff - 2008-08-03

Logged In: YES
user_id=464661
Originator: YES

Hi,

No problem to wait a bit - nothing really urgent here.

The Japanese translation you refer to concern the Debconf templates only (used by Debian users to configure the default behaviour of a package when installed). Nothing interesting for you there.

You can subscribe to bug reported against rkhunter Debian package at: http://packages.qa.debian.org/r/rkhunter.html (right column, 'PTS subscribtion')

Cheers,
Julien

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

John Horne - 2008-08-03

Logged In: YES
user_id=665381
Originator: NO

The current version of rkhunter in cvs has a fix for this now. The relevant 'rkhunter' file is version 1.160 (in cvs). You may want to take and compare this in order to patch the Debian version. The file has some odd bits of unfinished code, which I hope to have done by the 11th, so using this file (vers 1.160) just as a replacement may cause some unwanted problems.

John.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Julien Valroff - 2008-08-04

Logged In: YES
user_id=464661
Originator: YES

Hi John,

Thanks a lot for these explanations.
I have just uploaded an updated Debian package with this fix.

Cheers,
Julien

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Julien Valroff - 2008-08-04

status: open --> open-fixed
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

unSpawn - 2008-12-10

Since John fixed this in CVS I'll close this one as well.

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

unSpawn - 2008-12-10

status: open-fixed --> closed-fixed
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Log in to post a comment.