Tiger UNIX security tool - Tasks: task #3073, reduce check_finddeleted's false...
You are not allowed to post comments on this tracker with your current authentication level.
task #3073: reduce check_finddeleted's false positives
Submitter: | None | ||
Submitted: | Wed 28 Jan 2004 10:24:46 PM UTC | ||
Category: | Make Tiger easier to run/inst | Should Start On: | Wed 28 Jan 2004 12:00:00 AM UTC |
Should be Finished on: | Sat 28 Feb 2004 12:00:00 AM UTC | Priority: | 5 - Normal |
Status: | None | Privacy: | Public |
Percent Complete: | 40% | Assigned to: | Nekral |
Open/Closed: | Open | Effort: | 0.00 |
Attached Files
file #3467: check_finddeleted2 added by None (5KiB - application/octet-stream - new check_finddeleted: remove duplicates and help avoiding some reports)
Depends on the following items: None found
Items that depend on this one: None found
CC list is empty
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follows 1 latest change.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2004-01-28 | None | Attached File | - | ![]() |
Added check_finddeleted2, #3 |
check_finddeleted may produce many false positives.
I would like to:
- understand what produces these false positives and maybe find ways to avoid them,
- provide means for an user to ignore them with tiger.ignore.
A first attempt was proposed on the tiger-devel mailing list:
http://mail.gnu.org/archive/html/tiger-devel/2004-01/msg00003.html
A tiger script is now available. I'm actually testing/using it.
For example, I added the following lines to my tiger.ignore file to avoid false positives from apache and apache-ssl:
^Process apache(-ssl)? \(user: root, pid: ([0-9]+), process group id: \2\) of a server is using a deleted file: /tmp/session_mm_apache0\.sem \(size: 0, inode: [0-9]+\)$
^Process apache(-ssl)? \(user: www-data, pid: ([0-9]+), process group id: [0-9]+\) of a server is using a deleted file: /tmp/session_mm_apache0\.sem \(size: 0, inode: [0-9]+\)$