Package: chkrootkit Version: 0.52-2 Severity: normal There's a bug on line 1027 in /usr/sbin/chkrootkit:
if [ "${QUIET}" != "t" ];then printn "Searching for Suckit rootkit... "; fi if [ ${SYSTEM} != "HP-UX" ] && ( ${strings} ${ROOTDIR}sbin/init | ${egrep} '\.sniffer' || \ cat ${ROOTDIR}/proc/1/maps | ${egrep} "init." ) >/dev/null 2>&1 then # ignore false positive bug #740898 ==> readlink -f ${ROOTDIR}sbin/init|${egrep} -q "/sbin/upstart$|/systemd$" if [ $? -eq 0 ]; then if [ "${QUIET}" != "t" ]; then echo "nothing found"; fi else echo "Warning: ${ROOTDIR}sbin/init INFECTED" fi Running the script with xtrace on in that area confirms: + [ t != t ] + [ Linux != HP-UX ] + readlink -f /sbin/init + /bin/egrep -q /sbin/upstart$|/systemd$ + [ 1 -eq 0 ] + echo Warning: /sbin/init INFECTED Warning: /sbin/init INFECTED + set +x $ dlocate dlocate /sbin/init sysvinit-core: /sbin/init /sbin/init is _not_ a symlink on my system: $ ls -l /sbin/init -rwxr-xr-x 1 root root 40664 Sep 8 2017 /sbin/init the `egrep' command will fail, thus a Warning is produced. Patch suggestion: --- /usr/sbin/chkrootkit.orig 2018-06-14 19:09:12.190645377 +0200 +++ /usr/sbin/chkrootkit 2018-06-14 19:27:10.268114365 +0200 @@ -1024,7 +1024,7 @@ cat ${ROOTDIR}/proc/1/maps | ${egrep} "init." ) >/dev/null 2>&1 then # ignore false positive bug #740898 - readlink -f ${ROOTDIR}sbin/init|${egrep} -q "/sbin/upstart$|/systemd$" + [ ! -h ${ROOTDIR}sbin/init ] || readlink -f ${ROOTDIR}sbin/init|${egrep} -q "/sbin/upstart$|/systemd$" if [ $? -eq 0 ]; then if [ "${QUIET}" != "t" ]; then echo "nothing found"; fi else -- System Information: Debian Release: buster/sid APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.15.0-3-amd64 (SMP w/8 CPU cores) Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968), LANGUAGE=en_US:en (charmap=ANSI_X3.4-1968) Shell: /bin/sh linked to /bin/dash Init: sysvinit (via /sbin/init) Versions of packages chkrootkit depends on: ii binutils 2.30-21 ii debconf [debconf-2.0] 1.5.67 ii libc6 2.27-3 ii net-tools 1.60+git20161116.90da8a0-2 ii openssh-client 1:7.7p1-2 ii procps 2:3.3.15-2 chkrootkit recommends no packages. chkrootkit suggests no packages. -- Configuration Files: /etc/cron.daily/chkrootkit changed [not included] -- debconf information: * chkrootkit/run_daily_opts: -n -q -e '/usr/bin/slice' * chkrootkit/diff_mode: true * chkrootkit/run_daily: true Cheers, -- Cristian