Bug 70307 – tct-1.15 - lazarus cannot find /etc/magic when trying to create HTML formated recovery

• Status: RESOLVED TEST-REQUEST
• Product: Gentoo Linux

[Description J. Patrick Lanigan 2004-11-06 15:14:52 UTC]

I have searched the filesystem to see if it was just installed in the wrong place, but I haven't been able to find it. I tryed re-emerging and that did not help.

Reproducible: Always
Steps to Reproduce:
1. mount dd'ed file system at /dev/loop1
2. unrm /dev/loop1 > tct/unrm_output
3. lazarus -h unrm_output

Actual Results:  
Results in error:
Can't find the /etc/magic file

Expected Results:  
Create HTML formated output to analyse the free space in the filesystem.

# emerge info
Portage 2.0.51-r2 (default-x86-2004.2, gcc-3.3.4, glibc-2.3.4.20040808-r1,
2.4.27 i686)
=================================================================
System uname: 2.4.27 i686 AMD Athlon(tm) 
Gentoo Base System version 1.4.16
distcc 2.16 i686-pc-linux-gnu (protocols 1 and 2) (default port 3632) [enabled]
ccache version 2.3 [enabled]
Autoconf: sys-devel/autoconf-2.59-r5
Automake: sys-devel/automake-1.8.5-r1
Binutils: sys-devel/binutils-2.14.90.0.8-r1
Headers:  sys-kernel/linux-headers-2.4.21-r1
Libtools: sys-devel/libtool-1.5.2-r5
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CFLAGS="-O2 -march=athlon-xp -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
COMPILER=""
CONFIG_PROTECT="/etc /usr/X11R6/lib/X11/xkb /usr/kde/2/share/config
/usr/kde/3.3/env /usr/kde/3.3/share/config /usr/kde/3.3/shutdown
/usr/kde/3/share/config /usr/lib/mozilla/defaults/pref /usr/share/config
/usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/
/usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/
/usr/share/texmf/xdvi/ /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-O2 -march=athlon-xp -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoaddcvs ccache distcc distlocks sandbox"
GENTOO_MIRRORS="http://open-systems.ufl.edu/mirrors/gentoo
http://mirror.tucdemonic.org/gentoo/ ftp://ftp.gtlib.cc.gatech.edu/pub/gentoo
ftp://gentoo.ccccom.com"
MAKEOPTS="-j8"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage/lila-artwork /usr/local/portage/local"
SYNC="rsync://beast/gentoo-portage"
USE="3dnow X aim alsa apache2 apm arts avi berkdb bitmap-fonts cdr crypt cscope
ctype cups curl curlwrappers divx4linux doc dvd dvdr encode esd exif f77 flac
flash foomaticdb ftp gd gdbm gif gnome gphoto2 gpm gstreamer gtk gtk2 gtkhtml
imagemagick imap imlib ipv6 java jikes jpeg junit kde ldap libg++ libwww mad
mikmod mime ming mmx motif mozilla mpeg msn mysql ncurses nls oggvorbis opengl
oscar oss pam pcre pdflib perl php png postgres ppds python qt quicktime
readline samba scanner sdl slang soap spell sse ssl svga tcltk tcpd tetex theora
tidy tiff truetype usb vhosts wmf x86 xine xml2 xmms xsl xv xvid yahoo zlib"

[Comment 1 J. Patrick Lanigan 2004-11-06 16:04:56 UTC]

Workaround #1:

$ ln -s /usr/share/misc/file/magic /etc/magic
$ lazarus -h unrm_output
Couldn't find /usr/lib/tct/etc/magic, switching over to /etc/magic

Workaround #2:
$ mkdir /usr/lib/tct/etc
$ ln -s /usr/share/misc/file/magic /usr/lib/tct/etc/magic

I've currently got it running on a ~500MB file. It's going to take quite a while. I'll report back when it's done.

[Comment 2 Olivier Crete (RETIRED) 2004-11-06 21:10:06 UTC]

I can't find lazarus or tct in portage.. what package is this bug against?

[Comment 3 J. Patrick Lanigan 2004-11-06 23:35:02 UTC]

The coroners toolkit: app-forensics/tct masked by keyword ~x86

lazarus is a tool provided in this package.

BTW, it worked like a champ with the workaround in place. Not sure what other tools might be broken by the missing /usr/lib/tct/etc files. I'll using it a lot over the next week on a forensics project for school, so if I find any others, I'll post them.

[Comment 4 Aaron Walker (RETIRED) 2004-11-07 01:49:15 UTC]

The problem was that I missed the $magic_file variable in lazarus, when creating the gentoo patch.  I have committed 1.15-r1 with an updated patch.  Please test and verify that it solves the problem and let me know.

Thanks.

[Comment 5 J. Patrick Lanigan 2004-11-09 17:06:19 UTC]

Created attachment 43631 [details, diff]
Fixed missing semicolon in magic block.

Line 92 of /usr/lib/tct/bin/lazarus was missing a semicolon and produced the
error:

syntax error at /usr/sbin/lazarus line 92, near "die"
Execution of /usr/sbin/lazarus aborted due to compilation errors.

Added the semicolon as follows and it works fine:

#
#  we usually carry around the alternate magic file...
#
$magic_file="/usr/share/misc/file/magic";
die "Can't find $magic_file\n" unless (-f $magic_file);

Excuse my ignorance as to the process of submitting patches. I hope this is OK.
I fixed the tct-1.15-r1-gentoo.diff, rebuilt the digest, and re-emerged. Works
fine. The updated diff is attached

[Comment 6 Aaron Walker (RETIRED) 2004-11-10 05:30:04 UTC]

Usually diffs are the way to go.  For 1 byte though, it's probably a little overboard ;)  Anyways, I just fixed the patch.  Thanks again.