Attachment #852348 for bug #895176

View | Details | Raw Unified | Return to bug 895176
Collapse All | Expand All




# we exec to log everything to the debug file.
#

if [ -n "`echo \"$*\" | grep -- '--debug'`" ]; then
	RKHDEBUGFILE=""
	RKHDEBUGBASE="/tmp/rkhunter-debug"


# used. If it is, then some typical grep tests will fail.
#

if [ "`echo \"rkh-grep-test\" | grep '^+'`" = "rkh-grep-test" ]; then
	alias grep='grep -E'
fi


		#

		if [ "${OPT_NAME}" = "SHARED_LIB_WHITELIST" ]; then
			RKHTMPVAR=`echo "${OPT_VALUE}" | grep -E '(^|[^\\])[][?*]'`
		else
			RKHTMPVAR=`echo "${OPT_VALUE}" | grep -E '(^|[^\\])[][?*{}]'`
		fi

		if [ -n "${RKHTMPVAR}" ]; then

# The code is left here since we may need something very similar for overloaded options.
#   overloaded options - ALLOWPROCDELFILE PORT_PATH_WHITELIST RTKT_FILE_WHITELIST
#		if [ "${OPT_NAME}" = "BINDIR" ]; then
#			if [ -n "`echo \"${FNAME}\" | grep '^+'`" ]; then
#				FNAME=`echo "${FNAME}" | cut -c2-`
#			fi
#		fi

		# Also check that '/' has not been set.
		#

		if [ -n "`echo \"${FNAME}\" | grep -E '(^[./]*$)|[;&]|/\.\./'`" ]; then
			ERRCODE=1

			echo "Invalid ${OPT_NAME} configuration option: Invalid pathname: ${FNAME}"

				#

				if [ "${OPT_NAME}" = "SHARED_LIB_WHITELIST" ]; then
					if [ -n "`echo \"${FNAME}\" | grep -E '\\$\\{?(ORIGIN|LIB|PLATFORM)\\}?'`" ]; then
						continue
					fi
				fi

		PREPEND_PATHS=""

		for DIR in ${BINPATHS}; do
			if [ -n "`echo ${DIR} | grep '^+'`" ]; then
				DIR=`echo ${DIR} | cut -c2-`
				PREPEND_PATHS="${PREPEND_PATHS} ${DIR}"
			fi



		for DIR in ${PREPEND_PATHS} ${RKHROOTPATH} ${BINPATHS}; do
			if [ -n "`echo ${DIR} | grep '^+'`" ]; then
				# These will already be in PREPEND_PATHS.
				continue
			elif [ -z "`echo ${DIR} | grep '^/'`" ]; then

		#

		for RKHTMPVAR2 in ${RKHTMPVAR}; do
			if [ -n "`echo \"${RKHTMPVAR2}\" | grep -E -i '^(TCP|UDP):[1-9][0-9]*$'`" ]; then
				PROTO=`echo ${RKHTMPVAR2} | cut -d: -f1 | tr '[:lower:]' '[:upper:]'`
				PORT=`echo ${RKHTMPVAR2} | cut -d: -f2`


				PROTO=""

				# Dig out the protocol and port number, if present.
				if [ -n "`echo \"${RKHTMPVAR2}\" | grep -E -i '.:(TCP|UDP):[1-9][0-9]*$'`" ]; then
					PROTO=`echo "${RKHTMPVAR2}" | sed -e 's/^.*:\([a-zA-Z]*\):[1-9][0-9]*$/\1/'`
					PORT=`echo "${RKHTMPVAR2}" | sed -e 's/^.*:\([1-9][0-9]*\)$/\1/'`


		fi
	fi

	if [ -n "`echo \"${HASH_FUNC}\" | grep -E -i '^(MD5|SHA1|SHA224|SHA256|SHA384|SHA512|RIPEMD160|WHIRLPOOL|NONE)$'`" ]; then
		HASH_FUNC=`echo "${HASH_FUNC}" | tr '[:lower:]' '[:upper:]'`
	fi


		OSNAME="${OSNAME} `sw_vers 2>/dev/null | grep '^ProductVersion:' | sed -e 's/ProductVersion:[ 	]*//'`"
#		OSNAME="${OSNAME} `sysctl kern.version 2>/dev/null | sed -e 's/^kern.version = //' | cut -d: -f1`"

		if [ -n "`sysctl -a 2>/dev/null | grep -E '^(hw\.optional\.x86_64|hw\.optional\.64bitops|hw\.cpu64bit_capable).*1$'`" ]; then
			OSNAME="${OSNAME} (64-bit capable)"
		fi
		;;

						# this is what RPM does).
						#

						RPM_QUERY_RESULT=`echo "${RPM_QUERY_RESULT_ARCH}" | grep -E ':(x86_64|ia64):' 2>/dev/null | tail ${TAIL_OPT}1`

						test -z "${RPM_QUERY_RESULT}" && RPM_QUERY_RESULT=`echo "${RPM_QUERY_RESULT_ARCH}" | tail ${TAIL_OPT}1`


					if [ -n "${PKGNAME}" ]; then
						if [ -f "/var/lib/dpkg/info/${PKGNAME}.md5sums" ]; then
							FILNAM=`echo "${FNAME}" | sed -e 's:^/::; s:\.:\\\.:g'`
							SYSHASH=`grep -E "( |\./)${FILNAM}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" 2>/dev/null | cut -d' ' -f1`
							test -n "${SYSHASH}" && FILE_IS_PKGD=1
						fi
					fi

					SYSHASH=""
					RKHTMPVAR=`${HASH_CMD} "${FNAME}" 2>&1`

					if [ -n "`echo \"${RKHTMPVAR}\" | grep -E 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
						DEPENDENCY_ERR=1
						RKHTMPVAR=`echo "${RKHTMPVAR}" | tr '\n' ':' | sed -e 's/:$//'`
					else


	case $MIRRORS_MODE in
	0)
		MIRROR=`grep -E -i '^(local|remote|mirror)=https?://[-A-Za-z0-9+@#/%=_:,.]*[-A-Za-z0-9+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
		;;
	1)
		MIRROR=`grep -E -i '^local=https?://[-A-Za-z0-9+@#/%=_:,.]*[-A-Za-z0-9+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
		;;
	2)
		MIRROR=`grep -E -i '^remote=https?://[-A-Za-z0-9+@#/%=_:,.]*[-A-Za-z0-9+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}1`
		;;
	esac



		case $MIRRORS_MODE in
		0)
			MIRROR=`grep -E -i '^(local|remote|mirror)=https?://[-A-Za-z0-9+@#/%=_:,.]*[-A-Za-z0-9+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
			;;
		1)
			MIRROR=`grep -E -i '^local=https?://[-A-Za-z0-9+@#/%=_:,.]*[-A-Za-z0-9+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
			;;
		2)
			MIRROR=`grep -E -i '^remote=https?://[-A-Za-z0-9+@#/%=_:,.]*[-A-Za-z0-9+@#/%=_]$' "${DB_PATH}/mirrors.dat" 2>/dev/null | head ${HEAD_OPT}$N | tail ${TAIL_OPT}1 | cut -d= -f2-`
			;;
		esac


	# Next get the remaining mirrors.
	#

	OTHERMIRRORS=`grep -E -i '^(local|remote|mirror)=https?://[-A-Za-z0-9+@#/%=_:,.]*[-A-Za-z0-9+@#/%=_]$' "${DB_PATH}/mirrors.dat" | grep -v "^${MIRROR}\$"`


	#


		case $MIRRORS_MODE in
		0)
			MIRROR_COUNT=`grep -E -i '^(local|remote|mirror)=https?://[-A-Za-z0-9+@#/%=_:,.]*[-A-Za-z0-9+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
			;;
		1)
			MIRROR_COUNT=`grep -E -i '^local=https?://[-A-Za-z0-9+@#/%=_:,.]*[-A-Za-z0-9+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
			;;
		2)
			MIRROR_COUNT=`grep -E -i '^remote=https?://[-A-Za-z0-9+@#/%=_:,.]*[-A-Za-z0-9+@#/%=_]$' "${DB_PATH}/mirrors.dat" | wc -l | tr -d ' '`
			;;
		esac


	# Now check to see if any unknown options have been configured.
	#

	RKHTMPVAR=`grep -E -h -v '^[ 	]*(#|$)' ${CONFIGFILE} ${LOCALCONFIGFILE} ${LOCALCONFDIRFILES}`

	IFS=$IFSNL


		    rpc.nfsd:tcp.log:Sniffer installed
		    sshd:/dev/ptyxx:OpenBSD Rootkit
		    sshd:/.config:SHV4 Rootkit
		    sshd:+\\$.*\\$!.*!!\\$:Backdoored SSH daemon installed
		    sshd:backdoor.h:Trojaned SSH daemon
		    sshd:backdoor_active:Trojaned SSH daemon
		    sshd:magic_pass_active:Trojaned SSH daemon

		done


		if [ -n "`echo \"${RKHTMPVAR}\" | grep -E 'libsafe|missing|empty'`" ]; then
			display --to LOG --type WARNING --nl PROPUPD_WARN
		fi



						FILE_IS_PKGD=1

						PKGNAME=`echo "${PKGNAME_ARCH}" | grep -E '\.(x86_64|ia64)$' 2>/dev/null | tail ${TAIL_OPT}1`

						test -z "${PKGNAME}" && PKGNAME=`echo "${PKGNAME_ARCH}" | tail ${TAIL_OPT}1`


					if [ -n "${PKGNAME}" -a -f "/var/lib/dpkg/info/${PKGNAME}.md5sums" ]; then
						FNGREP=`echo "${FNAMEGREP}" | sed -e 's:^/::'`

						SYSHASH=`grep -E "( |\./)${FNGREP}\$" "/var/lib/dpkg/info/${PKGNAME}.md5sums" | cut -d' ' -f1`

						if [ -n "${SYSHASH}" ]; then
							FILE_IS_PKGD=1

							if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then
								PKGMGR_VERIFY_RESULT="5"

								if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | grep -E 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
									DEPENDENCY_ERR=1
								fi
							fi

							if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then
								PKGMGR_VERIFY_RESULT="5"

								if [ -n "`${PKGMGR_MD5_HASH} "${FNAME}" 2>&1 | grep -E 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
									DEPENDENCY_ERR=1
								fi
							fi

							if [ "${RKHTMPVAR}" != "${SYSHASH}" ]; then
								PKGMGR_VERIFY_RESULT="5"

								if [ -n "`${PKGMGR_SHA_HASH} "${FNAME}" 2>&1 | grep -E 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
									DEPENDENCY_ERR=1
								fi
							fi

						fi
					fi

					if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep -E '5|(^..\?)'`" ]; then
						HASH_TEST_PASSED=1
					else
						TEST_RESULT="${TEST_RESULT} verify:hashchanged"

							SYSHASH=`${HASH_CMD} "${FNAME}" 2>/dev/null | cut -d' ' -f $HASH_FLD_IDX`

							if [ -z "${SYSHASH}" ]; then
								if [ -n "`${HASH_CMD} "${FNAME}" 2>&1 | grep -E 'prelink.* (dependenc|adjusting unfinished)'`" ]; then
									if [ "${RKHHASH}" = "ignore-prelink-dep-err" ]; then
										SYSHASH="${RKHHASH}"
										display --to LOG --type INFO FILE_PROP_IGNORE_PRELINK_DEP_ERR "`name2text \"${FNAME}\"`"

					#

					if [ $FILE_IS_PKGD -eq 1 ]; then
						echo "${PKGMGR_VERIFY_RESULT}" | grep -E 'M|(^.\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:permchanged"
					else
						RKH_CC2=`expr $RKH_CC + 2`


					#

					if [ $FILE_IS_PKGD -eq 1 ]; then
						echo "${PKGMGR_VERIFY_RESULT}" | grep -E 'U|(^.....\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:uidchanged"
					else
						RKH_CC2=`expr $RKH_CC + 3`


					#

					if [ $FILE_IS_PKGD -eq 1 ]; then
						echo "${PKGMGR_VERIFY_RESULT}" | grep -E 'G|(^......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:gidchanged"
					else
						RKH_CC2=`expr $RKH_CC + 4`


					#

					if [ $FILE_IS_PKGD -eq 1 ]; then
						if [ -z "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep -E 'S|(^\?)'`" ]; then
							SIZE_TEST_PASSED=1
						else
							TEST_RESULT="${TEST_RESULT} verify:sizechanged"

					#

					if [ $FILE_IS_PKGD -eq 1 ]; then
						echo "${PKGMGR_VERIFY_RESULT}" | grep -E 'T|(^.......\?)' >/dev/null && TEST_RESULT="${TEST_RESULT} verify:dtmchanged"
					elif [ $PRELINKED -eq 0 -o $FILE_IS_PKGD -eq 0 ]; then
						RKH_CC2=`expr $RKH_CC + 6`



					if [ -h "${FNAME}" ]; then
						if [ $FILE_IS_PKGD -eq 1 ]; then
							if [ -n "`echo \"${PKGMGR_VERIFY_RESULT}\" | grep -E 'L|(^....\?)'`" ]; then
								if [ $HAVE_READLINK -eq 1 ]; then
									# Check the link target to see if it is whitelisted.


						RKHTMPVAR=`${LSATTR_CMD} "${FNAME}" 2>&1 | cut -d' ' -f1 | grep 'i'`
					fi
				else
					RKHTMPVAR=`ls -lno "${FNAME}" 2>&1 | ${AWK_CMD} '{ print $5 }' | grep -E 'uchg|schg|sappnd|uappnd|sunlnk|sunlink|schange|simmutable|sappend|uappend|uchange|uimmutable'`
				fi

				#

					test -n "${BASENAME_CMD}" && RKHTMPVAR=`${BASENAME_CMD} "${FNAME}"` || RKHTMPVAR=`echo "${FNAME}" | sed -e 's:^.*/::'`

					if [ "${RKHTMPVAR}" = "rkhunter" ]; then
						SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | grep -E -i -v '(shell|/bin/sh) script( |,|$)'`
					else
						SYSSCRIPT=`${FILE_CMD} "${FNAME}" 2>&1 | tr -d '\n' | tr '[:cntrl:]' '?' | grep -E -i ' script( |,|$)'`
					fi

					test -n "${SYSSCRIPT}" && TEST_RESULT="${TEST_RESULT} script"

				# Adding "text" to the egrep below widens scope at the expense of more false-positives and extending running time.
				#

				if [ -n "`echo \"${FTYPE}\" | grep -v -i 'compres' | grep -E -i 'execu|reloc|shell|libr|data|obj|text'`" ]; then
					FOUND=1
					SUSPSCAN_NUM=1; SUSPSCAN_SCORE=0; SUSPSCAN_HITCOUNT=0
					SUSPSCAN_STRINGS=""

	FOUND=0

	if [ -n "${KSYMS_FILE}" ]; then
		grep -E -i 'adore|sebek' "${KSYMS_FILE}" >/dev/null 2>&1 && FOUND=1
	fi

	if [ $FOUND -eq 0 ]; then


								FNAMEGREP=`echo "${FNAMEGREP}" | sed -e 's/^|//;'`

								if [ -n "`echo \"${FNAME}\" | grep -E \"^(${FNAMEGREP})$\"`" ]; then
									PROCWHITELISTED=1
								fi
							else

			RKHLSOF_FILE="${TEMPFILE}"
			touch "${RKHLSOF_FILE}"

			${LSOF_CMD} -wnlP +c 0 2>&1 | grep -E -v ' (FIFO|V?DIR|IPv[46]) ' | sort | uniq >"${RKHLSOF_FILE}"

			#
			# Now loop through the known suspicious filenames,

				ROOTKIT_COUNT=`expr $ROOTKIT_COUNT + 1`

				SEEN=1
				FOUND_PROCS=`${UNHIDE_CMD} ${UNHIDE_OPTS} ${RKHTMPVAR} 2>&1 | grep -E -v '^(Unhide |yjesus@|http:|Copyright |License |NOTE :|Used options:|\[\*\]|$)'`

				if [ -z "${FOUND_PROCS}" ]; then
					# Nothing found.

			IFS=$IFSNL

			# Get the default enabled services.
			for LINE in `grep -E '^[ 	]*enabled[ 	]*+?=' "${FILENAME}"`; do
				SEEN=1

				RKHTMPVAR=`echo "${LINE}" | sed -e 's/^.*=//' | tr -s '	' ' '`



			# Get the default disabled services.
			for LINE in `grep -E '^[ 	]*disabled[ 	]*+?=' "${FILENAME}"`; do
				RKHTMPVAR=`echo "${LINE}" | sed -e 's/^.*=//' | tr -s '	' ' '`

				XINETD_DFLTS_DISABLED="${XINETD_DFLTS_DISABLED} ${RKHTMPVAR}"

			#

			if [ -n "${XINETD_DFLTS_ENABLED}" ]; then
				if [ -n "`echo \"${XINETD_DFLTS_ENABLED}\" | grep -E \"${SVCID}\"`" ]; then
					if [ -z "`echo \"${XINETD_DFLTS_DISABLED}\" | grep -E \"${SVCID}\"`" ]; then
						SEEN=1
						IFS=$IFSNL
						break
					fi
				fi
			elif [ -n "`echo \"${XINETD_DFLTS_DISABLED}\" | grep -E \"${SVCID}\"`" ]; then
				:
			elif [ -z "`echo $DATA | grep 'disable = yes'`" ]; then
				SEEN=1

			test -f "${DIR}/mod_rootme2.so" && FOUNDFILES="${FOUNDFILES} ${DIR}/mod_rootme2.so"

			if [ -f "${DIR}/httpd.conf" ]; then
				if [ -n "`grep -E 'mod_rootme2?\.so' \"${DIR}/httpd.conf\"`" ]; then
					FOUNDFILES="${FOUNDFILES} ${DIR}/httpd.conf"
				fi
			fi

		${FIND_CMD} "${LKM_PATH}" -type f -a \( -name "*.o" -o -name "*.ko" -o -name "*.ko.xz" \) >"${TEMPFILE}" 2>/dev/null

		for RKHTMPVAR in ${LKM_NAMES}; do
			if [ -n "`grep -E \"/${RKHTMPVAR}(\.xz)?$\" "${TEMPFILE}"`" ]; then
				FOUND=1
				FOUNDFILES="${FOUNDFILES} ${RKHTMPVAR}"
			fi

			if [ -n "`echo \"${LSOFLINE}\" | grep \" ${PROTO} \*:${PORT} \"`" ]; then
				# Process listening for connections from anywhere.
				PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'`
			elif [ -n "`echo \"${LSOFLINE}\" | grep -E \" ${PROTO} [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:${PORT}[ -]\"`" ]; then
				# Established or listening process using IPv4 address.
				PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'`
			elif [ -n "`echo \"${LSOFLINE}\" | grep -E \" ${PROTO} \[[:0-9a-fA-F]+\]:${PORT}[ -]\"`" ]; then
				# Established or listening process using IPv6 address.
				PID=`echo "${LSOFLINE}" | ${AWK_CMD} '{ print $2 }'`
			else

			if [ "${PROTO}" = "UDP" ]; then
				FOUND=`${NETSTAT_CMD} -an | grep -i "^udp.*\.${PORT} " | ${AWK_CMD} '{ print $4 }' | grep "\.${PORT}$"`
			elif [ "${PROTO}" = "TCP" ]; then
				FOUND=`${NETSTAT_CMD} -an | grep -E -i "^tcp.*\.${PORT} .*(BOUND|ESTABLISH|LISTEN)" | ${AWK_CMD} '{ print $4 }' | grep "\.${PORT}$"`
			fi
			;;
		SunOS)

					FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^UDP: IPv6/, /^$/ { print $1 }' | grep "\.${PORT}$"`
				fi
			elif [ "${PROTO}" = "TCP" ]; then
				FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv4/, /^$/ { print $0 }' | grep -E 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"`

				if [ -z "${FOUND}" ]; then
					FOUND=`${NETSTAT_CMD} -an | ${AWK_CMD} '/^TCP: IPv6/, /^$/ { print $0 }' | grep -E 'BOUND|ESTABLISH|LISTEN' | ${AWK_CMD} '{ print $1 }' | grep "\.${PORT}$"`
				fi
			fi
			;;

	WHITEPROC=""
	BLACKPROC=""

	LIBPCAPRES=`grep -E -v '(^sk | 888e )' /proc/net/packet 2>/dev/null | head ${HEAD_OPT}1`

	if [ -n "${LIBPCAPRES}" ]; then
		ALLOWPROCLISTENERS=""


		INODE_LIST=""

		for INODE in `grep -E -v '(^sk | 888e )' /proc/net/packet | ${AWK_CMD} '{ print $9 }'`; do
			INODE_LIST="${INODE_LIST}|$INODE"
		done


		test -z "${INODE_LIST}" && INODE_LIST="RKHunterPktCapture"


		for PID in `${LSOF_CMD} -lMnPw -d 1-20 2>/dev/null | grep -E "[ 	](pack[ 	]+(${INODE_LIST})|sock[ 	]+[^ 	]+[ 	]+[^ 	]+[ 	]+(${INODE_LIST}))[ 	]" | ${AWK_CMD} '{ print $2 }'`; do
			NAME=""

			if [ -h "/proc/$PID/exe" -a $HAVE_READLINK -eq 1 ]; then

			RKHTMPVAR=`grep "${STRING}" "${FNAME}"`

			if [ -n "${RKHTMPVAR}" ]; then
				test -z "`echo \"${RKHTMPVAR}\" | grep -E -v '^[ 	]*#'`" && continue

				if [ -n "`echo \"${RTKT_FILE_WHITELIST}\" | grep \"^${FNAMEGREP}:${STRING}$\"`" ]; then
					if [ $VERBOSE_LOGGING -eq 1 ]; then

			if [ -n "${DSCL_CMD}" ]; then
				display --to LOG --type INFO FOUND_CMD 'dscl' "${DSCL_CMD}"

				RKHTMPVAR2=`${DSCL_CMD} . search /Users uid 0 | grep -E '^[^ 	)]' | cut -d'	' -f1`
			else
				display --to LOG --type INFO NOT_FOUND_CMD 'dscl'
			fi


			test $SUNOS -eq 1 -o $IRIXOS -eq 1 && PS_ARGS="-ef"

			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep -E '(syslogd|syslog-ng)( |$)' | grep -v 'grep'`

			if [ -n "${RKHTMPVAR}" ]; then
				SYSLOG_SEEN=1

				TITLE_SHOWN=1
			fi

			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep -E 'systemd-journald( |$)' | grep -v 'grep'`

			if [ -n "${RKHTMPVAR}" ]; then
				SYSTEMD_SEEN=1

				TITLE_SHOWN=1
			fi

			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep -E 'metalog( |$)' | grep -v 'grep'`

			if [ -n "${RKHTMPVAR}" ]; then
				METALOG_SEEN=1

				TITLE_SHOWN=1
			fi

			RKHTMPVAR=`${PS_CMD} ${PS_ARGS} | grep -E 'socklog( |$)' | grep -v 'grep'`

			if [ -n "${RKHTMPVAR}" ]; then
				SOCKLOG_SEEN=1

					RKHTMPVAR="an"
				elif [ -n "`echo \"${FNAME}\" | grep '/syslog-ng\.conf$'`" ]; then
					FTYPE="syslog-ng"
				elif [ -n "`echo \"${FNAME}\" | grep -E '/(systemd-)?journald\.conf$'`" ]; then
					FTYPE="systemd"
				else
					FTYPE="syslog"

				if [ "${FTYPE}" != "systemd" ]; then
					RKHTMPVAR=""

					if [ -n "`echo \"${FNAME}\" | grep -E '/r?syslog\.conf$'`" ]; then
						RKHTMPVAR=`grep -E -i '^[^#].*[ 	](@|:omrelp:).' "${FNAME}" | grep -E -i -v '(@|:omrelp:)127\.'`
					else
						#
						# For syslog-ng we must look for a destination
						# block which uses TCP or UDP.
						#

						RKHTMPVAR=`${AWK_CMD} '/^[ 	]*destination( |	|$)/, /}/ { print $0 }' "${FNAME}" | grep -E -i '( |	|\{|^)(tcp|udp)6?( |	|\(|$)' | grep -E -v -i '(tcp|udp)6?[ 	]*\([ 	]*("[ 	]*)?127\.'`
					fi

					if [ -n "${RKHTMPVAR}" ]; then

			# that the warnings are shown before anything else.
			#

			if [ $SYSLOG_SEEN -eq 1 -a -z "`echo \"${FILEFOUND}\" | grep -E ' (syslog|rsyslog|syslog-ng) '`" ]; then
				display --to SCREEN+LOG --type PLAIN --result WARNING --color RED --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_FILE
				display --to LOG --type WARNING SYSTEM_CONFIGS_SYSLOG_NO_FILE 'syslog'
			elif [ $SYSTEMD_SEEN -eq 1 -a -z "`echo \"${FILEFOUND}\" | grep ' systemd '`" ]; then

			# We only display the remote logging result if a configuration file was found.
			#

			if [ -n "`echo \"${FILEFOUND}\" | grep -E ' (syslog|rsyslog|syslog-ng) '`" ]; then
				if [ $ALLOW_SYSLOG_REMOTE_LOGGING -eq 1 ]; then
					display --to SCREEN+LOG --type PLAIN --result ALLOWED --color GREEN --log-indent 2 --screen-indent 4 SYSTEM_CONFIGS_SYSLOG_REMOTE
				elif [ $REM_LOGGING_FOUND -eq 0 ]; then

		FTYPE=`echo "${FTYPE}" | tail ${TAIL_OPT}1`
	fi

	if [ -z "`echo \"${FTYPE}\" | grep -E -v '(character special|block special|socket|fifo \(named pipe\)|symbolic link to|empty|directory|/MAKEDEV:)'`" ]; then
		return
	fi


			RKHTMPVAR=`find_cmd mount`

			if [ -n "${RKHTMPVAR}" ]; then
				test -n "`${RKHTMPVAR} 2>/dev/null | grep -E '^fdesc(fs)? .*(type fdesc|\(fdescfs\))'`" && FDESCFS=1
			else
				display --to LOG --type INFO NOT_FOUND_CMD 'mount'
			fi


	for DIR in ${SHORTSEARCHDIRS}; do
		if [ -d "${DIR}" ]; then
			RKHTMPVAR=`ls -1d ${DIR}/.* 2>/dev/null | grep -E -v '/\.\.?$'`
			test -n "${RKHTMPVAR}" && LOOKINDIRS="${LOOKINDIRS}
${RKHTMPVAR}"
		fi


		FTYPE=`${FILE_CMD} "${FNAME}" 2>&1 | ${AWK_CMD} -F':' '{ print $NF }' | cut -c2-`

		test -n "`echo \"${FTYPE}\" | grep -E 'character special|block special|empty'`" && continue

		FNAMEGREP=`echo "${FNAME}" | sed -e 's/\([.$*?\\]\)/\\\\\1/g; s/\[/\\\\[/g; s/\]/\\\\]/g'`


				;;
			named)
				WHOLE_VERSION=`${APP_CMD_FOUND} -v 2>/dev/null`
				VERSION=`echo "${WHOLE_VERSION}" | grep -E '^(named|BIND)[ 	][ 	]*[0-9]' | grep -v '/' | ${AWK_CMD} '{ print $2 }'`

				if [ -n "`echo \"${VERSION}\" | grep '^[^-]*\.[0-9][0-9]*-P[^-]*-'`" ]; then
					VERSION=`echo "${VERSION}" | cut -d'-' -f1-2`

			if [ -n "`echo \"${APP_WHITELIST}\" | grep -i \" ${APPLICATION}:${RKHTMPVAR} \"`" ]; then
				APP_RESULTS="${APP_RESULTS}
${APPLICATION}%${APPLICATION_DESC}%${VERSION}%-1"
			elif [ -n "`grep -E -i \"^${APPLICATION}:.* ${RKHTMPVAR}( |$)\" \"${DB_PATH}/programs_bad.dat\" 2>&1`" ]; then
				APPS_FAILED_COUNT=`expr ${APPS_FAILED_COUNT} + 1`

				APP_RESULTS="${APP_RESULTS}

	#

	echo $ECHOOPT ""
	echo $ECHOOPT "Usage: rkhunter {--check | --unlock | --update | --versioncheck |"
	echo $ECHOOPT "                 --propupd [{filename | directory | package name},...] |"
	echo $ECHOOPT "                 --list [{tests | {lang | languages} | rootkits | perl | propfiles}] |"
	echo $ECHOOPT "                 --config-check | --version | --help} [options]"

# required commands are tested early on using just the root PATH. Then
# BINDIR is checked, and finally the rest of the commands are then
# checked using the new PATH from BINDIR.
ABSOLUTELY_REQUIRED_CMDS="cut grep sed tail tr"
REQCMDS="awk cat chmod chown cp cut date grep head ls mv sed sort tail touch tr uname uniq wc"

# This will be set to a list of commands that have been disabled.
DISABLED_CMDS=""

	#

	if [ -z "${PRELINK_HASH}" ]; then
		if [ -z "`echo \"${HASH_FUNC}\" | grep -E '(/filehashsha\.pl Digest::MD5|/filehashsha\.pl .* 1$|shasum -a 1$)'`" ]; then
			RKHTMPVAR=`echo "${HASH_FUNC}" | cut -d' ' -f1`

			if [ -z "`echo ${RKHTMPVAR} | grep -E -i 'sha1|md5'`" ]; then
				if [ $HASH_OPT -eq 1 ]; then
					echo "This system uses prelinking, but the '--hash' option (${HASH_FUNC}) does not look like SHA1 or MD5."
				else

#
IFS=$IFSNL

for LINE in `grep -E '^MSG_(TYPE|RESULT)_' "${DB_PATH}/i18n/en" 2>/dev/null`; do
	TYPE=`echo "${LINE}" | cut -d: -f1`

	if [ "${LANGUAGE}" != "en" ]; then

			fi
		elif [ -n "${PRELINK_HASH}" ]; then
			display --to LOG --type INFO HASH_FUNC_PRELINK "${PRELINK_HASH}"
		elif [ -z "`echo \"${HASH_FUNC}\" | grep -E -i 'sha1|md5'`" ]; then
			SKIP_HASH_MSG=1
		else
			display --to LOG --type INFO HASH_FUNC "${HASH_FUNC}"

Return to bug 895176