<div class="gmail_quote">On Sun, May 17, 2009 at 10:35 AM, Gene Heskett <<a href="mailto:gene.heskett@verizon.net">gene.heskett@verizon.net</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Greetings all; What is /dev/shm? I've given up on rkhunter ever shutting up about the group and passwd files, but fussing about this is new. ---------------------- Start Rootkit Hunter Scan ---------------------- Warning: Suspicious file types found in /dev: /dev/shm/sem.ADBE_REL_root: data /dev/shm/sem.ADBE_WritePrefs_root: data /dev/shm/sem.ADBE_ReadPrefs_root: data And indeed, these files that I nuked friday are back: [root@coyote linux-2.6.30-rc6]# ls -l /dev/shm total 24 -r-------- 1 root root 67108904 2009-05-16 02:37 pulse-shm-3724332759 -rw-rw-rw- 1 root root 16 2009-05-16 20:33 sem.ADBE_ReadPrefs_root -rw-rw-rw- 1 root root 16 2009-05-16 20:33 sem.ADBE_REL_root -rw-rw-rw- 1 root root 16 2009-05-16 20:33 sem.ADBE_WritePrefs_root Anything with 'pulse' in its name has been nuked by an 'rpm -e', and I</blockquote><div> You should have not, but it is your choice. </div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> actually have working audio now, so can someone please explain this? A 67 megabyte file in /dev for an shm device is for what purpose? I looked at it with mc's hex viewer, and the first 10 or so megabytes are all $00. I got tired of standing on the page down key. </blockquote><div> Just add these rules to /etc/rkhunter.conf, in the appropriate place: # Allow the specified files to be present in the /dev directory, # and not regarded as suspicious. One file per line (use multiple # ALLOWDEVFILE lines). # #ALLOWDEVFILE=/dev/abc #ALLOWDEVFILE=/dev/shm/pulse-shm-* # Adobe Reader (acroread) 9.x ALLOWDEVFILE=/dev/shm/sem.ADBE_ReadPrefs_[a-zA-Z]* ALLOWDEVFILE=/dev/shm/sem.ADBE_REL_[a-zA-Z]* ALLOWDEVFILE=/dev/shm/sem.ADBE_WritePrefs_[a-zA-Z]*</div></div> -- Paulo Roma Cavalcanti LCG - UFRJ