readdir and checksecurity

[Christian Robottom Reis <kiko@async.com.br>]

Hi there,

    one of our servers (which runs Debian Woody) was recently
compromised, and had a suckit variant installed. We've gone through the
reinstall and restore steps, and one of the things I looked at is
debian's /usr/sbin/checksecurity script, which checks for changes in
setuid files. 

    Now suckit alters the system call table to provide specific
functionality to the attacker; one of these is to make specified files
and directories invisible to readdir(3) through a hacked getdents(2)
proxy function.

My question is: doesn't this situation sort of invalidate
checksecurity's setuid check, since setuid files that are in "hidden"
directories won't show up in the listing?

Take care,
--
Christian Robottom Reis | http://async.com.br/~kiko/ | [+55 16] 261 2331