taskTiger UNIX security tool - Tasks: task #3073, reduce check_finddeleted's false...

 
 

You are not allowed to post comments on this tracker with your current authentification level.

task #3073: reduce check_finddeleted's false positives

Submitted by:  None
Submitted on:  Wed 28 Jan 2004 10:24:46 PM UTC  
 
Category: Make Tiger easier to run/instShould Start On: Wed 28 Jan 2004 12:00:00 AM UTC
Should be Finished on: Sat 28 Feb 2004 12:00:00 AM UTCPriority: 5 - Normal
Status: NonePrivacy: Public
Percent Complete: 40%Assigned to: Nicolas FRANÇOIS <Nekral>
Open/Closed: OpenEffort: 0.00

Wed 28 Jan 2004 10:24:46 PM UTC, original submission:

check_finddeleted may produce many false positives.

I would like to:
- understand what produces these false positives and maybe find ways to avoid them,
- provide means for an user to ignore them with tiger.ignore.

A first attempt was proposed on the tiger-devel mailing list:
http://mail.gnu.org/archive/html/tiger-devel/2004-01/msg00003.html

A tiger script is now available. I'm actually testing/using it.

For example, I added the following lines to my tiger.ignore file to avoid false positives from apache and apache-ssl:

^Process apache(-ssl)? \(user: root, pid: ([0-9]+), process group id: \2\) of a server is using a deleted file: /tmp/session_mm_apache0\.sem \(size: 0, inode: [0-9]+\)$
^Process apache(-ssl)? \(user: www-data, pid: ([0-9]+), process group id: [0-9]+\) of a server is using a deleted file: /tmp/session_mm_apache0\.sem \(size: 0, inode: [0-9]+\)$

Anonymous

 

Attached Files
file #3467:  check_finddeleted2 added by None (5kB - application/octet-stream - new check_finddeleted: remove duplicates and help avoiding some reports)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follows 1 latest change.

Date Changed By Updated Field Previous Value => Replaced By
Wed 28 Jan 2004 10:24:46 PM UTCNoneAttached File-=>Added check_finddeleted2, #3

Back to the top


Powered by Savane 3.1-cleanup