[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: chkrootkit and lkm



This one time, at band camp, Michael Parkinson said:
> 
> Umm, I have the same problem.
> 
> If I kill Exim and Spamassassin no hidden processes reported.
> 
> Under normal load sometimes get 1-7 hidden processes.   Was is a state of
> panic but it does appear that Exim and Spamassassin combined do create false
> positives.

This is a known bug in chkrootkit - there is a race condition in the
code such that on a relatively busy system (or a sluggish one), there is a
difference in the ouput because of time lag - first it checks ps, then
it checks /proc, and if they disagree, it reports.

> Can this be fixed?

Hopefully.  It is irksome, but not the end of the world.

-- 
 -----------------------------------------------------------------
|   ,''`.					     Stephen Gran |
|  : :' :					 sgran@debian.org |
|  `. `'			Debian user, admin, and developer |
|    `-					    http://www.debian.org |
 -----------------------------------------------------------------

Attachment: pgpJXzYwOtVqa.pgp
Description: PGP signature


Reply to: