Tiger UNIX security tool - Patches: patch #7859, Fix for the aide_run script to...
You are not allowed to post comments on this tracker with your current authentication level.
patch #7859: Fix for the aide_run script to support AIDE 0.15.1 reports
Submitter: | pyllyukko <pyllyukko> | ||
Submitted: | Sat 06 Oct 2012 08:26:57 PM UTC | ||
Category: | Security test | Priority: | 5 - Normal |
Status: | None | Privacy: | Public |
Assigned to: | None | Open/Closed: | Open |
Attached Files
Depends on the following items: None found
Items that depend on this one: None found
Carbon-Copy List
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follows 1 latest change.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2012-10-06 | pyllyukko | Attached File | - | Added tiger-aide.patch, #26715 |
Powered by Savane 3.13-4448.
Corresponding source code
When I run Tiger on a system that has AIDE 0.15.1 installed, the aide_run script gives false negatives. It does not detect properly that AIDE has found differences on the file system.
Few regular expression modifications should fix this issue, see the attached patch.
Here are few lines from my AIDE report to demonstrate why it doesn't work:
"AIDE 0.15.1 found differences between database and filesystem!!" - version string after "AIDE" text
" Total number of files: ..." - 2 x space prefix