taskTiger UNIX security tool - Tasks: task #3073, reduce check_finddeleted's false...


You are not allowed to post comments on this tracker with your current authentication level.

task #3073: reduce check_finddeleted's false positives

Submitter:  None
Submitted:  Wed 28 Jan 2004 10:24:46 PM UTC
Category:  Make Tiger easier to run/inst Should Start On:  Wed 28 Jan 2004 12:00:00 AM UTC
Should be Finished on:  Sat 28 Feb 2004 12:00:00 AM UTC Priority:  5 - Normal
Status:  None Privacy:  Public
Percent Complete:  40% Assigned to:  Nekral
Open/Closed:  Open Effort:  0.00

Wed 28 Jan 2004 10:24:46 PM UTC, original submission:  

check_finddeleted may produce many false positives.

I would like to:
  - understand what produces these false positives and maybe find ways to avoid them,
  - provide means for an user to ignore them with tiger.ignore.

A first attempt was proposed on the tiger-devel mailing list:

A tiger script is now available. I'm actually testing/using it.

For example, I added the following lines to my tiger.ignore file to avoid false positives from apache and apache-ssl:

^Process apache(-ssl)? \(user: root, pid: ([0-9]+), process group id: \2\) of a server is using a deleted file: /tmp/session_mm_apache0\.sem \(size: 0, inode: [0-9]+\)$
^Process apache(-ssl)? \(user: www-data, pid: ([0-9]+), process group id: [0-9]+\) of a server is using a deleted file: /tmp/session_mm_apache0\.sem \(size: 0, inode: [0-9]+\)$



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #3467:  check_finddeleted2 added by None (5KiB - application/octet-stream - new check_finddeleted: remove duplicates and help avoiding some reports)


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.


Follows 1 latest change.

Date Changed by Updated Field Previous Value => Replaced by
2004-01-28 None Attached File- Added check_finddeleted2, #3

Back to the top

Powered by Savane 3.12