Fri Sep 23 23:14:53 UTC 2011

1 files changed, 11 insertions, 161 deletions

diff --git a/extra/chkrootkit/fix-tools-path.patch b/extra/chkrootkit/fix-tools-path.patch
index 2f3c38528..d45f07901 100644
--- a/extra/chkrootkit/fix-tools-path.patch
+++ b/extra/chkrootkit/fix-tools-path.patch
@@ -1,161 +1,11 @@
---- chkrootkit	2008-01-19 11:01:15.000000000 +0100
-+++ chkrootkit	2008-11-01 13:11:14.000000000 +0100
-@@ -158,23 +158,23 @@
-     fi
- 
-     if [ "${EXPERT}" = "t" ]; then
--        expertmode_output "./ifpromisc" -v
-+        expertmode_output "/usr/bin/ifpromisc" -v
-         return 5
-     fi
--    if [ ! -x ./ifpromisc ]; then
--      echo "not tested: can't exec ./ifpromisc"
-+    if [ ! -x /usr/bin/ifpromisc ]; then
-+      echo "not tested: can't exec /usr/bin/ifpromisc"
-       return ${NOT_TESTED}
-     else
--      [ "${QUIET}" != "t" ] && ./ifpromisc -v || ./ifpromisc -q
-+      [ "${QUIET}" != "t" ] && /usr/bin/ifpromisc -v || /usr/bin/ifpromisc -q
-     fi
- }
- 
- chkutmp() {
--    if [ ! -x ./chkutmp ]; then
--      echo "not tested: can't exec ./chkutmp"
-+    if [ ! -x /usr/bin/chkutmp ]; then
-+      echo "not tested: can't exec /usr/bin/chkutmp"
-       return ${NOT_TESTED}
-     fi
--    if ./chkutmp
-+    if /usr/bin/chkutmp
-     then
-       if [ "${QUIET}" != "t" ]; then echo "chkutmp: nothing deleted"; fi
-     fi
-@@ -182,8 +182,8 @@
- }
- 
- z2 () {
--    if [ ! -x ./chklastlog ]; then
--      echo "not tested: can't exec ./chklastlog"
-+    if [ ! -x /usr/bin/chklastlog ]; then
-+      echo "not tested: can't exec /usr/bin/chklastlog"
-       return ${NOT_TESTED}
-     fi
- 
-@@ -196,32 +196,32 @@
-     fi
- 
-     if [ "${EXPERT}" = "t" ]; then
--        expertmode_output "./chklastlog -f ${WTMP} -l ${LASTLOG}"
-+        expertmode_output "/usr/bin/chklastlog -f ${WTMP} -l ${LASTLOG}"
-         return 5
-     fi
- 
--    if ./chklastlog -f ${WTMP} -l ${LASTLOG}
-+    if /usr/bin/chklastlog -f ${WTMP} -l ${LASTLOG}
-     then
-       if [ "${QUIET}" != "t" ]; then echo "chklastlog: nothing deleted"; fi
-     fi
- }
- 
- wted () {
--    if [ ! -x ./chkwtmp ]; then
--      echo "not tested: can't exec ./chkwtmp"
-+    if [ ! -x /usr/bin/chkwtmp ]; then
-+      echo "not tested: can't exec /usr/bin/chkwtmp"
-       return ${NOT_TESTED}
-     fi
- 
-    if [ "$SYSTEM" = "SunOS" ]; then
--       if [ ! -x ./check_wtmpx ]; then
--          echo "not tested: can't exec ./check_wtmpx"
-+       if [ ! -x /usr/bin/check_wtmpx ]; then
-+          echo "not tested: can't exec /usr/bin/check_wtmpx"
-        else
-           if [ "${EXPERT}" = "t" ]; then
--             expertmode_output "./check_wtmpx"
-+             expertmode_output "/usr/bin/check_wtmpx"
-               return 5
-           fi
- 	  if [ -f ${ROOTDIR}var/adm/wtmp ]; then
--             if ./check_wtmpx
-+             if /usr/bin/check_wtmpx
-                 then
-                 if [ "${QUIET}" != "t" ]; then \
-                    echo "check_wtmpx: nothing deleted in /var/adm/wtmpx"; fi
-@@ -232,12 +232,12 @@
-        WTMP=`loc wtmp wtmp "${ROOTDIR}var/log ${ROOTDIR}var/adm"`
- 
-        if [ "${EXPERT}" = "t" ]; then
--          expertmode_output "./chkwtmp -f ${WTMP}"
-+          expertmode_output "/usr/bin/chkwtmp -f ${WTMP}"
-           return 5
-        fi
-     fi
- 
--    if ./chkwtmp -f ${WTMP}
-+    if /usr/bin/chkwtmp -f ${WTMP}
-     then
-       if [ "${QUIET}" != "t" ]; then echo "chkwtmp: nothing deleted"; fi
-     fi
-@@ -275,8 +275,8 @@
-     prog=""
-     if [  \( "${SYSTEM}" = "Linux"  -o \( "${SYSTEM}" = "FreeBSD" -a \
-        `echo ${V} | ${awk} '{ if ($1 > 4.3 || $1 < 6.0) print 1; else print 0 }'` -eq 1 \) \) -a "${ROOTDIR}" = "/" ]; then
--      [  -x ./chkproc -a "`find /proc | wc -l`" -gt 1 ] && prog="./chkproc"
--      [  -x ./chkdirs ] && prog="$prog ./chkdirs"
-+      [  -x /usr/bin/chkproc -a "`find /proc | wc -l`" -gt 1 ] && prog="/usr/bin/chkproc"
-+      [  -x /usr/bin/chkdirs ] && prog="$prog /usr/bin/chkdirs"
-       if [ "$prog" = "" ]; then
-          echo "not tested: can't exec $prog"
-          return ${NOT_TESTED}
-@@ -288,7 +288,7 @@
-          PV=`$ps -V 2>/dev/null| $cut -d " " -f 3 |${awk} -F . '{ print $1 "." $2 $3 }' | ${awk} '{ if ($0 > 3.19) print 3; else if ($0 < 2.015) print 1; else print 2 }'`
-          [ "$PV" = "" ] &&  PV=2
-          [ "${SYSTEM}" = "SunOS" ] && PV=0
--         expertmode_output "./chkproc -v -v -p $PV"
-+         expertmode_output "/usr/bin/chkproc -v -v -p $PV"
-          return 5
-       fi
- 
-@@ -315,7 +315,7 @@
-       if [ "${DEBUG}" = "t" ]; then
-            ${echo} "*** PV=$PV ***"
-       fi
--      if ./chkproc -p ${PV}; then
-+      if /usr/bin/chkproc -p ${PV}; then
-          if [ "${QUIET}" != "t" ]; then echo "chkproc: nothing detected"; fi
-       else
-          echo "chkproc: Warning: Possible LKM Trojan installed"
-@@ -324,7 +324,7 @@
-       for i in /usr/share /usr/bin /usr/sbin /lib; do
-          [ -d $i ] && dirs="$dirs $i"
-       done
--      if ./chkdirs $dirs;  then
-+      if /usr/bin/chkdirs $dirs;  then
-          if [ "${QUIET}" != "t" ]; then echo "chkdirs: nothing detected"; fi
-       else
- 	    echo "chkdirs: Warning: Possible LKM Trojan installed"
-@@ -1690,18 +1690,18 @@
- 
-    if [ "${SYSTEM}" = "Linux" ]
-    then
--      if [ ! -x ./strings-static ]; then
--        printn "can't exec ./strings-static, "
-+      if [ ! -x /usr/bin/strings-static ]; then
-+        printn "can't exec /usr/bin/strings-static, "
-         return ${NOT_TESTED}
-       fi
- 
-       if [ "${EXPERT}" = "t" ]; then
--          expertmode_output "./strings-static -a ${CMD}"
-+          expertmode_output "/usr/bin/strings-static -a ${CMD}"
-           return 5
-       fi
- 
-       ### strings must be a statically linked binary.
--      if ./strings-static -a ${CMD} > /dev/null 2>&1
-+      if /usr/bin/strings-static -a ${CMD} > /dev/null 2>&1
-       then
-          STATUS=${INFECTED}
-       fi
+--- chkrootkit
++++ chkrootkit
+@@ -17,6 +17,8 @@ unalias netstat > /dev/null 2>&1
+ unalias ps > /dev/null 2>&1
+ unalias dirname > /dev/null 2>&1
+ 
++cd /usr/sbin
++
+ # Workaround for recent GNU coreutils
+ _POSIX2_VERSION=199209
+ export _POSIX2_VERSION