Ubuntu
rkhunter package

Wildcards in Whitelists Do Not Function Correctly on Hidden Directories (Begin with a Period)

Bug #1453952 reported by Jared Fernandez
18
This bug affects 4 people
Affects Status Importance Assigned to Milestone
rkhunter (Ubuntu)
Confirmed
Medium
Unassigned

Bug Description

apt-cache policy rkhunter:
rkhunter:
  Installed: 1.4.2-0.4
  Candidate: 1.4.2-0.4

lsb_release -rd:
Description: Ubuntu 15.04
Release: 15.04

Whitelisting files/directories with wildcards in the ALLOWDEVFILE parameter not working as expected and are still reported as suspicious:

In /etc/rkhunter.conf:
ALLOWDEVFILE=/dev/shm/byobu-*

Output:
Warning: Suspicious file types found in /dev:
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/updates_available: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/hostname: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/whoami: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/disk: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/memory: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/cpu_freq: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/cpu_count: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/load_average: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/cpu_temp: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/uptime: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/users: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/session: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/arch: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/release: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/distro: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/logo: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/.last.tmux/network: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/width: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/cpu_freq: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/load_average: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/cpu_count: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/users: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/disk: ASCII text, with very long lines, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/memory: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/cpu_temp: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/uptime: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/hostname: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/release: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/whoami: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/session: very short file (no magic)
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/arch: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/distro: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/status.tmux/logo: UTF-8 Unicode text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/updates-available: ASCII text
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/network.down: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/network.down.dev: ASCII text
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/network.up: ASCII text, with no line terminators
         /dev/shm/byobu-admin-gxyPtUEs/cache.tmux/network.up.dev: ASCII text

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in rkhunter (Ubuntu):
status: New → Confirmed
Revision history for this message
Roger Binns (ubuntu-rogerbinns) wrote :

Some of them go away when you include wildcards. I have this in rkhunter.conf:

ALLOWDEVFILE=/dev/shm/byobu-*/*/*

That suppresses most of the warnings, with some remaining due to being hidden files or directories.

Alberto Salvia Novella (es20490446e)
Changed in rkhunter (Ubuntu):
importance: Undecided → Medium
Revision history for this message
Jared Fernandez (jared-fernandez) wrote :

I was able to solve the issue I was seeing here by changing the rkhunter configuration to include the following lines:

ALLOWDEVFILE=/dev/shm/byobu-*-????????/.last.tmux/*
ALLOWDEVFILE=/dev/shm/byobu-*-????????/*/*
ALLOWDEVFILE=/dev/shm/byobu-*-????????/*
ALLOWDEVFILE=/dev/shm/sem.*

There are two things at play here:

1.) As Roger Binns pointed out, the asterisk at the end of the line is only good for a single directory level of wildcard match, so to match all the levels, multiple lines must be added, one for each level.

2.) The wildcard match does not appear to be working correctly for directories that start with a period (such as .last.tmux), which I do believe to actually be a bug. By manually specifying ".last.tmux" instead of an asterisk for that level, the ALLOWDEVFILE declaration will then function correctly.

In my case, I used the question marks to limit what is to be whitelisted since the string here will always be exactly 8 characters. For extra security, if you have very few users that login (or only a single user), rather than using an asterisk after the "byobu-", you could manually specify the allowed user here to narrow down the whitelist even further.

I will update the title on this bug to reflect the issue of the wildcard not matching directories that begin with a period.

summary: - Wildcards in "ALLOWDEVFILE" Not Working
+ Wildcards in Whitelists Do Not Function Correctly on Hidden Directories
+ (Begin with a Period)
Revision history for this message
latimerio (fomember) wrote :

I have the same problem with ASCII text with no line terminators on ubuntu 18.04 LTS.
I do not see what is wrong having no line terminators in an ASCII file.
So please make this at least a configurable ALLOW option.
I also get messages like below which I also think should be allowed

 /dev/shm/byobu-myuser-CLwl8Ngj/status.tmux/session: very short file (no magic)
 /dev/shm/byobu-myuser-CLwl8Ngj/status.tmux/disk: ASCII text, with very long lines, with no line terminators
  dev/shm/byobu-myuser-CLwl8Ngj/sockets: ASCII text

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.