Bug 226067 - chkrootkit-0.47: shell history anomalies warning for linked files uses wrong file list
Bug#: 226067 Product:  Gentoo Linux Version: unspecified Platform: All
OS/Version: Linux Status: RESOLVED Severity: normal Priority: P2
Resolution: FIXED Assigned To: forensics@gentoo.org Reported By: prote@fmi.uni-stuttgart.de
Component: Applications
URL: 
Summary: chkrootkit-0.47: shell history anomalies warning for linked files uses wrong file list
Keywords:  
Status Whiteboard: 
Opened: 2008-06-12 13:38 0000
Description:   Opened: 2008-06-12 13:38 0000
In its "shell history anomalies" part chkrootkit collects two lists of
anomalous history files:
- $files: file size is zero
- $files1: is linked to another file
But when the according warning is written both times $files is used.
For details see the attached diff.

Reproducible: Always

Steps to Reproduce:
None of the files target, .link-history and .empty-history should exist.
1. echo Hallo > target
2. ln target .link-history
3. touch .empty-history
4. chkrootkit

Actual Results:  
...
Searching for anomalies in shell history files... Warning:
`//root/.empty-history' file size is zero
Warning: `//root/.empty-history' is linked to another file
...

Expected Results:  
...
Searching for anomalies in shell history files... Warning:
`//root/.empty-history' file size is zero
Warning: `//root/.link-history' is linked to another file
...

------- Comment #1 From Horst Prote 2008-06-12 13:40:09 0000 -------
Created an attachment (id=156497) [details]
diff between the original and corrected chkrootkit script

------- Comment #2 From Peter Volkov 2008-10-06 19:46:21 0000 -------
Fixed in chkrootkit-0.48. Thank you for report and fix.