Package: chkrootkit
Version: 0.49-1
Severity: normal

Because the daily cron job runs with 'set -e' it fails whenever chkrootkit
exits with a non-zero exit code. However because chkrootkit tests in the
order $TROJAN $TOOLS (internal external) the exit code of the script is
whatever happens to be the exit code of the last external tool.

Previously the last external tool was chkutmp a standalone program that
returns with an exit code of 0 on succes. With the addition of OSX_RSPLUG to
the list the exit code of the script is now the exit code of the OSX_RSPLUG
test. Normally it returns NOT_INFECTED. Which is defined as 1. Hence the
non-zero exit code.

See the difference:

   # chkrootkit chkutmp; echo $?
   ROOTDIR is `/'
   Checking `chkutmp'...         chkutmp: nothing deleted
   0

and

   # chkrootkit OSX_RSPLUG; echo $?
   ROOTDIR is `/'
   Checking `OSX_RSPLUG'...      not infected
   1

Maybe the script should contain an explicit 'exit 0' at the end to indicate
that all went well?


Arjan


-- System Information:
Debian Release: squeeze/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.27.21 (PREEMPT)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages chkrootkit depends on:
ii  binutils              2.19.51.20090805-1 The GNU assembler, linker and bina
ii  debconf [debconf-2.0] 1.5.27             Debian configuration management sy
ii  libc6                 2.9-23             GNU C Library: Shared libraries
ii  net-tools             1.60-23            The NET-3 networking toolkit
ii  procps                1:3.2.8-1          /proc file system utilities

chkrootkit recommends no packages.

chkrootkit suggests no packages.

-- debconf information:
* chkrootkit/run_daily_opts: -q -n
* chkrootkit/run_daily: true
* chkrootkit/diff_mode: true



-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Reply via email to