Bug List: (This bug is not in your last search results)   Show last search results      Search page      Enter new bug
Bug#: 57701
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: solar <solar@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Aaron Walker (RETIRED) <ka0ttic@gentoo.org>
Add CC:
CC:
URL:
Summary:
Status Whiteboard:
Keywords:

Filename Description Type Creator Created Size Actions
03-chkrootkit-0.43-r3.diff 03-chkrootkit-0.43-r3.diff patch Aaron Walker (RETIRED) 2004-07-20 03:26 0000 490 bytes Details | Diff
chkrootkit-0.43-r2.diff chkrootkit-0.43-r2.diff patch Aaron Walker (RETIRED) 2004-07-24 14:03 0000 498 bytes Details | Diff
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 57701 depends on: Show dependency tree
Bug 57701 blocks:
Votes: 0    Show votes for this bug    Vote for this bug

Additional Comments: (this is where you put emerge --info)


Not eligible to see or edit group visibility for this bug.






View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2004-07-20 03:19 0000 
chkrootkit's strings-static binary is not statically compiled because of the
line, "make strings || die" in the ebuild, since there is no "strings" target
in the
Makefile (but strings.c exists, so it builds it anyways instead of
complaining).

The fix is just to remove that line altogether, since strings-static gets built
with the "sense" target.  This also means we can get rid of the call to newsbin
and just add strings-static to dosbin.

------- Comment #1 From Aaron Walker (RETIRED) 2004-07-20 03:26:33 0000 ------- 
Created an attachment (id=35801) [details]
03-chkrootkit-0.43-r3.diff

------- Comment #2 From Aaron Walker (RETIRED) 2004-07-24 14:03:05 0000 ------- 
Created an attachment (id=36091) [details]
chkrootkit-0.43-r2.diff

The other patch was an incremental patch based on an ebuild patched to fix
another chkrootkit bug.  So, here is the diff of the current
chkrootkit-0.43-r2.ebuild

------- Comment #3 From solar 2004-07-28 21:06:13 0000 ------- 
playing ping pong with me guys?

It must be destiny that this bug made it's way to me for a second time after
I've already bounced this back to bug-wranglers@ before.

Alot of chkrootkit internals were overridden by some patch (not your patch Aaron) which made it use everything dynamic. 
This is a flaw in the design on that patch as
the goal should be to use known safe virus free programs/and dynamic
linker and libraries to preform our tests. 

Consider a small LD_PRELOAD module which overrode these dynamic programs 
functions and hide the non trojaned values from us.

This strings-static might be just one of the programs which are effected
by this patch (not your patch Aaron).

Anyway I've put this in CVS as-is to help return some of the sainity for forensics.
Bug List: (This bug is not in your last search results)   Show last search results      Search page      Enter new bug