Bug#762877: Warning: Hidden directory found: /dev/.lxc
xiscu
xiscu at email.de
Thu Sep 25 20:52:00 UTC 2014
Package: rkhunter
Version: 1.4.0-3
Severity: normal
Dear Maintainer,
I'm getting daily rkhunter cron jobs reports with the message:
"""
Warning: Hidden directory found: /dev/.lxc
"""
AFAIN I have just beeing updating the system, I've checked
the config files but I haven't found any ALLOWDEVS ... or
ALLOWHIDDEN... with that directory name in it (no hint).
IHMO if that's normal it should not be a warning.
Thanks in advance!
xiscu
-- System Information:
Debian Release: jessie/sid
Architecture: amd64 (x86_64)
Kernel: Linux 3.14-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages rkhunter depends on:
ii binutils 2.24.51.20140903-1
ii debconf [debconf-2.0] 1.5.53
ii file 1:5.19-2
ii net-tools 1.60-26
ii perl 5.20.0-6
ii ucf 3.0030
Versions of packages rkhunter recommends:
ii curl 7.38.0-1
ii exim4-daemon-light [mail-transport-agent] 4.84-2
ii iproute 1:3.16.0-2
ii lsof 4.86+dfsg-1
ii unhide 20121229-1
ii wget 1.15-1+b1
Versions of packages rkhunter suggests:
pn bsd-mailx | mailutils | heirloom-mailx | mailx <none>
pn libdigest-whirlpool-perl <none>
ii liburi-perl 1.64-1
ii libwww-perl 6.08-1
ii powermgmt-base 1.31+nmu1
ii tripwire 2.4.2.2-4
-- Configuration Files:
/etc/default/rkhunter changed:
CRON_DAILY_RUN="yes"
CRON_DB_UPDATE="yes"
DB_UPDATE_EMAIL="false"
REPORT_EMAIL="root"
APT_AUTOGEN=""
NICE="0"
RUN_CHECK_ON_BATTERY="false"
/etc/rkhunter.conf changed:
ROTATE_MIRRORS=1
UPDATE_MIRRORS=1
MIRRORS_MODE=0
MAIL-ON-WARNING=""
MAIL_CMD=mail -s "[rkhunter] Warnings found for ${HOST_NAME}"
TMPDIR=/var/lib/rkhunter/tmp
DBDIR=/var/lib/rkhunter/db
SCRIPTDIR=/usr/share/rkhunter/scripts
UPDATE_LANG=""
LOGFILE=/var/log/rkhunter.log
APPEND_LOG=0
COPY_LOG_ON_ERROR=0
COLOR_SET2=0
AUTO_X_DETECT=1
WHITELISTED_IS_WHITE=0
ALLOW_SSH_ROOT_USER=no
ALLOW_SSH_PROT_V1=0
ENABLE_TESTS="all"
DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps apps"
SCRIPTWHITELIST=/bin/egrep
SCRIPTWHITELIST=/bin/fgrep
SCRIPTWHITELIST=/bin/which
SCRIPTWHITELIST=/usr/bin/groups
SCRIPTWHITELIST=/usr/bin/ldd
SCRIPTWHITELIST=/usr/bin/lwp-request
SCRIPTWHITELIST=/usr/sbin/adduser
SCRIPTWHITELIST=/usr/sbin/prelink
IMMUTABLE_SET=0
PHALANX2_DIRTEST=0
ALLOWDEVFILE="/dev/shm/pulse-shm-*"
ALLOW_SYSLOG_REMOTE_LOGGING=0
SUSPSCAN_TEMP=/dev/shm
SUSPSCAN_MAXSIZE=10240000
SUSPSCAN_THRESH=200
USE_LOCKING=0
LOCK_TIMEOUT=300
SHOW_LOCK_MSGS=1
DISABLE_UNHIDE=0
INSTALLDIR="/usr"
-- debconf information:
rkhunter/cron_db_update: yes
rkhunter/apt_autogen:
rkhunter/cron_daily_run: yes
More information about the forensics-devel
mailing list