[SOLVED] Question about a warning in rkhunter

gurkan · 2017-12-29 17:08:06

Hi!

I have noticed some warnings when running rkhunter that I cant find something on, so I hope some of you guys here maybe can help me.

Checking /dev for suspicious file types         [ Warning ]
[16:56:41] Warning: Suspicious file types found in /dev:
[16:56:41]          /dev/shm/u1000-Shm_125376fc: data
[16:56:41]          /dev/shm/u1000-Shm_2fad50d: data
[16:56:41]          /dev/shm/u1000-Shm_1b974cf3: data
[16:56:41]          /dev/shm/pulse-shm-3637036988: data
[16:56:41]          /dev/shm/u1000-Shm_11b8dc07: data
[16:56:41]          /dev/shm/u1000-Shm_bd857ed0: data
[16:56:41]          /dev/shm/u1000-Shm_3c3a3c3d: data
[16:56:41]          /dev/shm/u1000-Shm_c9edbd50: data
[16:56:42]          /dev/shm/u1000-Shm_784b9aa3: data
[16:56:42]          /dev/shm/u1000-ValveIPCSharedObj5: data
[16:56:42]   Checking for hidden files and directories       [ Warning ]

I think I have read before that "pulse-shm" can be because of pulseaudio, but the u1000, I have no idea

Last edited by gurkan (2017-12-30 11:42:51)

lo1 · 2017-12-29 22:23:42

/dev/shm is generally used as a "physical" (I know, not the best definition) location for tmpfs, this means that we have no idea what those warnings are, unless you make an effort to understand what your system is running and ask if it is safe to ignore those warnings.

[16:56:42]          /dev/shm/u1000-ValveIPCSharedObj5: data

This looks like steam (?) leftovers, anyway check your filesystems with

df -h

and post the output here, that's a good start.

Last edited by lo1 (2017-12-29 22:28:12)

seth · 2017-12-29 22:43:49

Hmmm.... what could u1000 mean? Who knows? It's a mystery.

id -u

gurkan · 2017-12-30 01:44:45

[gurkan@i7archpower ~]$ id
uid=1000(gurkan) gid=100(users) grupper=100(users),10(wheel)
[gurkan@i7archpower ~]$ id -u
1000
[gurkan@i7archpower ~]$ df -h
Filsystem      Size  Used  Free  Use% Mounted on
dev               3,9G      0   3,9G   0% /dev
run               3,9G   880K   3,9G   1% /run
/dev/sda1         100G    85G    11G  89% /
tmpfs             3,9G   129M   3,8G   4% /dev/shm
tmpfs             3,9G      0   3,9G   0% /sys/fs/cgroup
tmpfs             3,9G    24M   3,9G   1% /tmp
tmpfs             791M    20K   791M   1% /run/user/1000
[gurkan@i7archpower ~]$

So if I get this right.. Is it files from my own user, like "leftovers" that has no meaning? In Arch wiki it says "tmpfs is a temporary filesystem that resides in memory and/or swap partition(s). Mounting directories as tmpfs can be an effective way of speeding up accesses to their files, or to ensure that their contents are automatically cleared upon reboot. "

I rarely shut down my computer, but I hibernate/suspend every now and then, can it be it? I looked up in my file manager and in /run/user/1000 I have som maps with names like "systemd", "pulse", "gvfs", "gnupg", "dconf" and "dbus-1".

Last edited by gurkan (2017-12-30 01:46:20)

seth · 2017-12-30 09:29:55

This is first and foremost shared memory. https://en.wikipedia.org/wiki/Shared_memory

Whether or not it's "leftovers" is a matter of whether the clients using them forgot to tidy up.
=>

man lsof

gurkan · 2017-12-30 10:24:17

So if I understand this correct, its just what you say "shared memory"? I did a Bleachbit cleanup and restarted my computer, and after that, Rkhunter doesnt show anything:

 [11:11:36]   Checking /dev for suspicious file types         [ None found ]

wikipedia wrote:

The shared memory created by shm_open is persistent. It stays in the system until explicitly removed by a process. This has a drawback that if the process crashes and fails to clean up shared memory it will stay until system shutdown.
Linux distributions based on the 2.6 kernel and later offer /dev/shm as shared memory in the form of a RAM disk, more specifically as a world-writable directory (a directory in which every user of the system can create files) that is stored in memory. Both the RedHat and Debian based distributions include it by default. Support for this type of RAM disk is completely optional within the kernel configuration file.[5

Do I get it straight, on a noob level? Because if, then I can mark this thread a solved .

Thank you for your time

seth · 2017-12-30 11:27:49

A reboot alone would have nuked those files (since they're on a tmpfs)

--- OT, rant ---

"Bleachshit" does not "cleanup" anything but it deletes random files that may or not still be in use (yes, that *is* a problem because though the file handles are kept open, the data behind is now at risk) based upon voodoo graylisting. And when it crashes, you'll soon run out of inodes. Very smart people use it to "safely erase" data so it can explicitly write random junk into possibly mmaped files. m(

tl;Dr: Do not use it. The approach is stupid and the implementation wonky at best.
If it has a mode to *suggest* files, that would seem to be ok for a tool to assist you getting some free disk space. But do not let it auto-delete stuff, that's russian roulette.

Instead do what bleachshit *should* be doing and check whether those files are still in use. If not, it's safe to delete them (clients will re-create them in doubt, just like cache files which this over-zealous tool deletes so that your applications have to waste CPU cycles to re-create them on the next run) - this might also tell you what relates to the questionable files, maybe really solving the (iff a) problem.

gurkan · 2017-12-30 11:42:05

Alright. I will remove Bleachbit, didnt know it was "that bad".

I will have an eye on this, but the main "problem" is solved, this has to do with temporary files and not a rootkit or malware. Thank you!

Arch Linux

#1 2017-12-29 17:08:06

[SOLVED] Question about a warning in rkhunter

#2 2017-12-29 22:23:42

Re: [SOLVED] Question about a warning in rkhunter

#3 2017-12-29 22:43:49

Re: [SOLVED] Question about a warning in rkhunter

#4 2017-12-30 01:44:45

Re: [SOLVED] Question about a warning in rkhunter

#5 2017-12-30 09:29:55

Re: [SOLVED] Question about a warning in rkhunter

#6 2017-12-30 10:24:17

Re: [SOLVED] Question about a warning in rkhunter

#7 2017-12-30 11:27:49

Re: [SOLVED] Question about a warning in rkhunter

#8 2017-12-30 11:42:05

Re: [SOLVED] Question about a warning in rkhunter

Board footer