Subject: rkhunter default config false warning re: systemd

From: "Jon C. LeBlanc" <[email-masked]>
Date: Mon, 15 Jul 2019 19:26:48 +0000

Package: Rootkit Hunter 1.4.6
Devuan version: Beowulf
uname -a output: Linux coho 4.19.0-5-amd64 #1 SMP Debian 4.19.37-5 (2019-06-19) x86_64 GNU/Linux

The rkhunter package's default /etc/rkhunter.conf configuration generates a warning when it cannot find systemd, so could you please add the following to the default /etc/rkhunter.conf file:

RTKT_FILE_WHITELIST=/var/run/udev.pid

After adding that line the warning is eliminated, but there is a second config entry that does not pass the 'rkhunter -C' configuration file self-check:

DISABLE_UNHIDE=1

When I commented that line the warning went away. I have not debugged that warning so I don't know what it is about.

Thanks!

---

From: Mark Hindley <[email-masked]>
Date: Mon, 3 Feb 2020 11:22:01 +0000

Control: tags -1 debian

Jon,

Sorry for the slow reply.

rkhunter is not a forked package and we use the Debian pacakge directly. 
Therefore we have no way of fixing this in Devuan.

I suggest you look at similar bugs on Debian's BTS (#926936 looks 
promising) and add your voice there.

Thanks

Mark

---

From: Svante Signell <[email-masked]>
Date: Mon, 03 Feb 2020 13:04:46 +0100

> promising) and add your voice there.

This problem is already solved with eudev 3.2.9-1, by renaming
/run/udev.pid to /run/udevd.pid. This release of eudev closes the
related Devuan bug #292. If you are running earlier versions of eudev,
you might continue to get it solved within Debian.

Thanks!

---

From: Mark Hindley <[email-masked]>
Date: Wed, 11 Jan 2023 12:36:07 +0000

On Mon, Feb 03, 2020 at 01:04:46PM +0100, Svante Signell wrote:
> /run/udev.pid to /run/udevd.pid.

Closing as fixed. Thanks

Mark