Another rkhunter question

[Bill Davidsen]

Paulo Cavalcanti wrote:
> 
> 
> On Sun, May 17, 2009 at 10:35 AM, Gene Heskett <gene.heskett at verizon.net 
> <mailto:gene.heskett at verizon.net>> wrote:
> 
>     Greetings all;
> 
>     What is /dev/shm?
> 
>     I've given up on rkhunter ever shutting up about the group and
>     passwd files,
>     but fussing about this is new.
>     ---------------------- Start Rootkit Hunter Scan ----------------------
>     Warning: Suspicious file types found in /dev:
>             /dev/shm/sem.ADBE_REL_root: data
>             /dev/shm/sem.ADBE_WritePrefs_root: data
>             /dev/shm/sem.ADBE_ReadPrefs_root: data
> 
>     And indeed, these files that I nuked friday are back:
>     [root at coyote linux-2.6.30-rc6]# ls -l /dev/shm
>     total 24
>     -r-------- 1 root root 67108904 2009-05-16 02:37 pulse-shm-3724332759
>     -rw-rw-rw- 1 root root       16 2009-05-16 20:33 sem.ADBE_ReadPrefs_root
>     -rw-rw-rw- 1 root root       16 2009-05-16 20:33 sem.ADBE_REL_root
>     -rw-rw-rw- 1 root root       16 2009-05-16 20:33
>     sem.ADBE_WritePrefs_root
> 
Do you have some Adobe stuff installed? And might you ever accidentally have 
used it as root? Just looking at the name, I know you're old enough to know 
better. ;-)

>     Anything with 'pulse' in its name has been nuked by an 'rpm -e', and I
> 
> 
> You should have not, but it is your choice.
>  
Is there a better way to get rid of PulseAudio? Some install option which 
prevents infecting the system in the first place?
> 
> 
>     actually have working audio now, so can someone please explain this?
>      A 67
>     megabyte file in /dev for an shm device is for what purpose?
> 
>     I looked at it with mc's hex viewer, and the first 10 or so
>     megabytes are all
>     $00.  I got tired of standing on the page down key.
> 
> 
> Just add these rules to /etc/rkhunter.conf, in the appropriate place:
> 
>  # Allow the specified files to be present in the /dev directory,
> # and not regarded as suspicious. One file per line (use multiple
> # ALLOWDEVFILE lines).
> #
> #ALLOWDEVFILE=/dev/abc
> #ALLOWDEVFILE=/dev/shm/pulse-shm-*
> # Adobe Reader (acroread) 9.x
> ALLOWDEVFILE=/dev/shm/sem.ADBE_ReadPrefs_[a-zA-Z]*
> ALLOWDEVFILE=/dev/shm/sem.ADBE_REL_[a-zA-Z]*
> ALLOWDEVFILE=/dev/shm/sem.ADBE_WritePrefs_[a-zA-Z]*
> 
> 
> -- 
> Paulo Roma Cavalcanti
> LCG - UFRJ
> 


-- 
Bill Davidsen <davidsen at tmr.com>
   "We have more to fear from the bungling of the incompetent than from
the machinations of the wicked."  - from Slashdot