Bug#866373: rkhunter: /dev/null is recognized as an ASCII file

[Andreas Schwarz]

Package: rkhunter
Version: 1.4.2-6
Severity: normal

Dear Maintainer,

we get strange warnings from rkhunter on debian stretch.
Minimal command to reproduce: rkhunter --check --enable filesystem

Result: 
Info: Starting test name 'filesystem'
Performing filesystem checks
Info: SCAN_MODE_DEV set to 'THOROUGH'
  Checking /dev for suspicious file types         [ Warning ]
Warning: Suspicious file types found in /dev:
         /dev/null?: ASCII text

Debug Output (--debug):
[...]
+ /usr/bin/find /dev ! -type d -a ! -type l
+ [ 0 -eq 1 ]
+ echo /dev/null^M
+ grep /\.[^/]*$
+ test -z 
+ do_dev_whitelist_check
+ /usr/bin/file /dev/null^M
+ awk -F: { print $NF } 
+ cut -c2-
+ FTYPE=ASCII text
+ echo ASCII text
+ grep universal binary
+ [ 0 -eq 1 -a -n  ] 
+ echo ASCII text
+ egrep -v (character special|block special|socket|fifo \(named pipe\)|symbolic link to|empty|directory|/MAKEDEV:)
+ [ -z ASCII text ]
+ echo /dev/null^M
+ sed -e s/\([.$*?\]\)/\\\1/g; s/\[/\\[/g; s/\]/\\]/g
+ FNAMEGREP=/dev/null^M
+ echo  
+ grep ^/dev/null^M$
+ [ -n  ] 
+ FOUNDFILES=
/dev/null^M: ASCII text
[...]

Manual check:
/usr/bin/file /dev/null
/dev/null: character special (1/3)

/usr/bin/file /dev/null|awk -F: '{ print $NF }'|cut -c2-
character special (1/3)

-- System Information:
Debian Release: 9.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-3-amd64 (SMP w/16 CPU cores)
Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8), LANGUAGE=de_DE.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages rkhunter depends on:
ii  binutils               2.28-5
ii  debconf [debconf-2.0]  1.5.61
ii  file                   1:5.30-1
ii  lsof                   4.89+dfsg-0.1
ii  net-tools              1.60+git20161116.90da8a0-1
ii  perl                   5.24.1-3
ii  ucf                    3.0036

Versions of packages rkhunter recommends:
pn  bsd-mailx | mailutils | heirloom-mailx | mailx  <none>
ii  curl                                            7.52.1-5
ii  iproute2                                        4.9.0-1
ii  postfix [mail-transport-agent]                  3.1.4-7
ii  unhide                                          20130526-1
ii  unhide.rb                                       22-2
ii  wget                                            1.18-5

Versions of packages rkhunter suggests:
ii  liburi-perl     1.71-1
ii  libwww-perl     6.15-1
pn  powermgmt-base  <none>

-- Configuration Files:
/etc/rkhunter.conf changed [not included]

-- debconf information excluded