On Sun, 2025-02-09 at 10:52 +0100, François Patte wrote: > Since I solved this problem, rkhunter bores me with "Suspicious file > types found in /dev:" > > /dev/shm/lttng-ust-wait-8 > > If I ask lsof to see what uses this "suspicious" file, I get : > COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME > wireplumb 2505 fp mem REG 0,24 4096 2 > /dev/shm/lttng-ust-wait-8 > > Is it a really "suspicious" file? And, if not, why rkhunter is not aware > of these kinds of files? > > Shall I whitelist it without any danger? You might want to change the subject line, some people don't read every message posted and someone with the answer to a rkhunter query may not see your message. I see *old* data about them: https://www.linuxquestions.org/questions/linux-security-4/suspicious-rkhunter-entry-for-dev-shm-lttng-ust-wait-7-1000-ubuntu-18-04-1-a-4175678671/ https://unix.stackexchange.com/questions/227184/what-is-dev-shm-lttng-ust-wait-5-for As a general answer, those (rkhunter) kind of programs are always after-the-fact. Any time there's a change in how a system works, or a new exploit in the wild, they don't know about it until they're updated. And some things, like transient files, mightn't be possible to categorically declare them to always be safe, or risky. In a case like this, I don't necessarily mean a "dnf update" to your install. But probably that the program itself needs a change in how it works. There's every chance that you might have to ask the question directly with rkhunter's support. And they could easily turn around and say it's a unique quirk of Fedora, and they should manage the problem. That's one problem with using protective software like them (rkhunter, ABRT, SELinux troubleshooter, anti-virus, etc). You have to know how to deal with its results to actually be able to use it. When people don't, they go around deleting files they shouldn't, allowing things they shouldn't, or just ignoring all the things they warn about. -- uname -rsvp Linux 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 Boilerplate: All unexpected mail to my mailbox is automatically deleted. I will only get to see the messages that are posted to the mailing list. -- _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
