taskTiger UNIX security tool - Tasks: task #3073, reduce check_finddeleted's false...


You are not allowed to post comments on this tracker with your current authentication level.

task #3073: reduce check_finddeleted's false positives

Submitted by:  None
Submitted on:  Wed 28 Jan 2004 10:24:46 PM UTC  
Category:  Make Tiger easier to run/inst Should Start On:  Wed 28 Jan 2004 12:00:00 AM UTC
Should be Finished on:  Sat 28 Feb 2004 12:00:00 AM UTC Priority:  5 - Normal
Status:  None Privacy:  Public
Percent Complete:  40% Assigned to:  Nicolas FRANÇOIS <Nekral>
Open/Closed:  Open Effort:  0.00

Wed 28 Jan 2004 10:24:46 PM UTC, original submission:  

check_finddeleted may produce many false positives.

I would like to:
  - understand what produces these false positives and maybe find ways to avoid them,
  - provide means for an user to ignore them with tiger.ignore.

A first attempt was proposed on the tiger-devel mailing list:

A tiger script is now available. I'm actually testing/using it.

For example, I added the following lines to my tiger.ignore file to avoid false positives from apache and apache-ssl:

^Process apache(-ssl)? \(user: root, pid: ([0-9]+), process group id: \2\) of a server is using a deleted file: /tmp/session_mm_apache0\.sem \(size: 0, inode: [0-9]+\)$
^Process apache(-ssl)? \(user: www-data, pid: ([0-9]+), process group id: [0-9]+\) of a server is using a deleted file: /tmp/session_mm_apache0\.sem \(size: 0, inode: [0-9]+\)$



Attached Files
file #3467:  check_finddeleted2 added by None (5KiB - application/octet-stream - new check_finddeleted: remove duplicates and help avoiding some reports)


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


Do you think this task is very important?
If so, you can add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.




Follows 1 latest change.

Date Changed by Updated Field Previous Value => Replaced by
2004-01-28 None Attached File- => Added check_finddeleted2, #3

Back to the top

Powered by Savane 3.7