Check rkhunter warnings For Deleted Files

logfile- /var/log/rkhunter.log starts
[partial starts]
[19:18:58] Info: Starting test name ‘malware’
[19:18:58] Performing malware checks
[19:18:58]
[19:18:58] Info: Starting test name ‘deleted_files’
[19:19:35] Checking running processes for deleted files [ Warning ]
[19:19:35] Warning: The following processes are using deleted files:
[19:19:35] Process: /usr/bin/pulseaudio PID: 784 File: /memfd:pulseaudio
[19:19:35] Process: /usr/bin/gnome-shell PID: 1151 File: /tmp/mutter-shared-67ER4Y
[19:19:35] Process: /usr/bin/pulseaudio PID: 1173 File: /memfd:pulseaudio
[19:19:35] Process: /usr/lib/evolution-data-server/evolution-source-registry PID: 1194 File: /home/donato/.local/share/gvfs-metadata/home
[19:19:35] Process: /usr/bin/python2.7 PID: 1472 File: /tmp/vteZY4V4Y
[19:19:35] Process: /usr/bin/megasync PID: 1484 File: /run/user/1000/wayland-cursor-shared-t6KVCM
[19:19:35] Process: /usr/lib/tracker/tracker-extract PID: 1491 File: /home/donato/.local/share/gvfs-metadata/root
[19:19:35] Process: /usr/lib/evolution/evolution-alarm-notify PID: 1492 File: /run/user/1000/wayland-cursor-shared-3IXo1U
[19:19:35] Process: /usr/bin/gnome-software PID: 1499 File: /run/user/1000/wayland-cursor-shared-VWIXlt
[19:19:35] Process: /usr/lib/libreoffice/program/soffice.bin PID: 1538 File: /run/user/1000/wayland-cursor-shared-RA1mRd
[19:19:36] Process: /usr/lib/firefox/firefox PID: 17646 File: /dev/shm/org.chromium.woa2Ti
[19:19:36] Process: /usr/bin/python3.6 PID: 17747 File: /dev/shm/org.chromium.OO0nrj
[19:19:36] Process: /usr/bin/evolution PID: 20854 File: /run/user/1000/wayland-cursor-shared-2ZlQUk
[19:19:36] Process: /usr/lib/webkit2gtk-4.0/WebKitWebProcess PID: 20894 File: /run/user/1000/wayland-cursor-shared-9nUAnZ
[19:19:36] Process: /usr/lib/firefox/firefox PID: 25985 File: /dev/shm/org.chromium.O45DxH
[19:19:36] Process: /usr/bin/rhythmbox PID: 30033 File: /run/user/1000/wayland-cursor-shared-DitbCG
[partial ends]
logfile-/var/log/rkhunter.log ends

I enabled ALLTEST in /etc/rkhunter.conf and put a # on the DISABLETEST list. I feel comfortable now that I have a handle on what I’m running on my system. I ran rkhunter and as I expected it gave me these warnings. All these processes are recognized and valid applications and presumably they are deleting these respective files because they don’t need it anymore. There’s nothing to see here. These aren’t the droids I’m looking for.

I have to whitelist these processes. The basic syntax for that job is : ALLOWPROCDELFILE=/path/to/process. You can specify the specific file with : ALLOWPROCDELFILE=/path/to/process:/path/to/filename.xxx.

For example: [19:19:35] Process: /usr/bin/pulseaudio PID: 784 File: /memfd:pulseaudio
append to /etc/rkhunter.conf
ALLOWPROCDELFILE=/usr/bin/pulseaudio

Another example: [19:19:35] Process: /usr/bin/gnome-shell PID: 1151 File: /tmp/mutter-shared-67ER4Y
append to /etc/rkhunter.conf
ALLOWPROCDELFILE=/usr/bin/gnome-shell:/tmp/mutter-shared-67ER4Y

You can also use * to represent any character.
Anytime you make changes to /etc/rkhunter.conf don’t forget to run the command : #rkhunter -C #to check the config file

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s