Bug#951338: libkeyutils1: rkhunter warns that libkeyutils.so.1.9 may contain a possible rootkit

2020-02-15 Thread Francesco Poli
On Sat, 15 Feb 2020 13:16:10 +0100 Christian Kastner wrote: > On 15.02.20 11:39, Francesco Poli wrote: [...] > > Is it wrong (or too late) to change that symbol into > > keyctl_move@KEYUTILS_1.10 ? > > Would that bump the SONAME again and generate libkeyutils.so.1.10 ? > > The SONAME didn't chang

Bug#951338: libkeyutils1: rkhunter warns that libkeyutils.so.1.9 may contain a possible rootkit

2020-02-15 Thread Christian Kastner
On 15.02.20 11:39, Francesco Poli wrote: > On Fri, 14 Feb 2020 23:15:08 +0100 Christian Kastner wrote: > OK, I am about to say something very idiotic here, because I am not too > familiar with versioned symbols in libraries. Hence, please bear with > me... > > Is it wrong (or too late) to change t

Bug#951338: libkeyutils1: rkhunter warns that libkeyutils.so.1.9 may contain a possible rootkit

2020-02-15 Thread Francesco Poli
On Fri, 14 Feb 2020 23:15:08 +0100 Christian Kastner wrote: [...] > On 14.02.20 20:21, Axel Beckert wrote: [...] > > IMHO this is a bug in rkhunter, but it could also be solved in > > keyutils by bumping the SONAME again, i.e. skipping this SONAME > > version explicitly. But feel free to reassign.

Bug#951338: libkeyutils1: rkhunter warns that libkeyutils.so.1.9 may contain a possible rootkit

2020-02-15 Thread Francesco Poli
On Fri, 14 Feb 2020 20:21:32 +0100 Axel Beckert wrote: [...] > Hi, Hello Axel, thanks a lot for looking into my bug report! > > Francesco Poli (wintermute) wrote: [...] > > Does libkeyutils1/1.6.1-2 ship a rootkit? > > Likely not. I looked through the whole diff between 1.6 and 1.6.1. At > lea

Bug#951338: libkeyutils1: rkhunter warns that libkeyutils.so.1.9 may contain a possible rootkit

2020-02-14 Thread Christian Kastner
Hi Axel, thank you for your effort in locating the cause of this! On 14.02.20 20:21, Axel Beckert wrote: > c459dfa4 (Francois Marier 2014-10-14 23:24:53 +1300 9958) >\[pdflush\]:IRC bot > eca1837f (Francois Marier 2017-07-01 20:33:17 -0700 9959) >

Bug#951338: libkeyutils1: rkhunter warns that libkeyutils.so.1.9 may contain a possible rootkit

2020-02-14 Thread Axel Beckert
Control: severity -1 normal Hi, Francesco Poli (wintermute) wrote: > After upgrading > > [UPGRADE] libkeyutils1:amd64 1.6-6 -> 1.6.1-2 > > I get the following warning with > > # rkhunter --sk -c > > in /var/log/rkhunter.log: > > Info: Starting test name 'running_procs' > Checking

Bug#951338: libkeyutils1: rkhunter warns that libkeyutils.so.1.9 may contain a possible rootkit

2020-02-14 Thread Francesco Poli (wintermute)
Package: libkeyutils1 Version: 1.6.1-2 Severity: grave Tags: security Justification: user security hole Hello! After upgrading [UPGRADE] libkeyutils1:amd64 1.6-6 -> 1.6.1-2 I get the following warning with # rkhunter --sk -c in /var/log/rkhunter.log: Info: Starting test name 'running_