On Fri, 29 Nov 2024 at 18:20, home user via users <users@xxxxxxxxxxxxxxxxxxxxxxx> wrote:
On 11/28/24 10:24 AM, home user via users wrote:
> (f-40, stand-alone workstation, gnome)
>
> A few times in the past couple of months, I've received the following warning from "chkrootkit":
> - - - - - -
> Checking `lkm'... You have 1 process hidden for ps command
> chkproc: Warning: Possible LKM Trojan installed
> What's going on with that lkm warning?
>
The google search results I saw were for ubantu and other "flavors" of Linux, but I did not notice anything for Fedora. (but I could easily have missed something)
There's a lot of commonality across most distros, so while something (the link I referenced, for example) was from an Ask Ubuntu branch of Stackexchange, a lot of the advice in it is still applicable.
Some minor implementation details may differ (package format obviously, maybe default configs) but a DEB chkrootkit is probably *very* close to an RPM packaged equivalent in both currency and behaviour.
You can even quickly compare/contrast some of this in Vagrant boxes or quickly spun up containers. I try to keep a bunch to hand for stuff just like this (https://github.com/wmcdonald404/wmcdonald404-vagrantfiles).
The google search results I saw were from nearly a decade ago and older. But when I did "dnf history chkrootkit" before opening this thread (and now), I saw (and still see) this:
1537 | upgrade | 2023-12-21 10:56 | C, E, I, O, U | 239 ><
So it seems to me that chkrootkit is still being maintained. wikipedia confirmed, both before opening this thread, and now.
If you've Googled / searched something, it's always worth letting people know that. Compare:
1. "I run this thing and get this result, what's going on?"
2. "I run this thing and get this result. I've Googled and read [X] and [Y], I *think* this [Z] might be what's happening but I'm not entirely sure?"
I always used to say to people who come to me with problems at work, write it down. If I ask 'have you checked logs" (for example), and they have but haven't a) said so in their written summary and b) haven't included what they found, or that there was nothing there, then that's being slightly selfish with other people's time.
I mean obviously sometimes you just need an immediate 2nd opinion, but taking a logical, structured approach to analysing and describing a problem will, IME, lead you to self-resolution 9 times out of 10. Bonus side effect, if you don't nail it, you have a fabulous problem description for others to help you with.
Yet them google search results, even from more than a decade ago, said that what I reported is a known problem with chkrootkit. After more than a decade, it ain't fixed?!
If you go read the Ubuntu thread, have you checked some of the advice to narrow down whether it is a false positive or not? Specifically these lines:
No, it is a false positive and a long standing bug in chrootkit. You will see the message any time the lkm check reports hidden processes inaccessible by the readdir command. If you have something like ClamAV, MySQL, Exim or MailScanner running you are bound to see this warning.
Easiest check: run chrootkit a couple of times with as many services stopped (ie. mysql, clamav etc). If the results vary it is a clear indicator it is a false positive.
Before opening this thread (and now), chkrootkit has no man page. I saw nothing helpful in chkrootkit -help (or -h) before opening this thread (and now).
Again, worth telling people "I've RTFMed and this is what I think, can someone confirm" or "I've tried to RTFM, there isn't one."
When it comes to Fedora and Linux matters, I much prefer to trust, and much more trust, the expert, professional, very experienced helpers in this list over google or any other internet search engine (or "AI"). This list's help is likely to be current and specific.
100%, but I (almost) always like to do (and demonstrate) legwork first personally. :) It's really just helping people help you, if that makes sense?
-- _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
