Dear Maintainer,

The regular running chkrootkit apparently creates a file '1' in the
directory /usr/lib/chkrootkit.  Checking for a supposed bad redirection
in the scripts of the package of chkrootkit (with "grep -n '> *1'
/etc/cron.daily/chkrootkit /usr/sbin/chkrootkit") found the following:

/usr/sbin/chkrootkit:1423:
${echo} >1 "$ROOTDIRproc/syslogk" > /dev/null 2>&1

This looks very strange, especially as I don't see a variable echo being
assigned anywhere.  I'm not quite sure what is intended here so I don't
try to speculate about a correct patch, sorry.

Best regards, Thomas

yes, ive spotted this one - i am working on a fix. and will be done soon,
but every time i look at the code i spot something else that is wrong.

this line is meant to be more along the lines of

${echo} 1 > "${ROOTDIR}proc/syslogk 2>/dev/null

($echo is defined by the main loop, although im sceptical it is actually
used given echo is a builtin)

( i am writing from memory and there is another
"redirection" that is even worse thsn this one so i may be misremebering)


... i will include some code to remove the "1" -.didnt think of this!

but at least you confirmed that this test was never working as intended!

yes, ive spotted this one - i am working on a fix. and will be done soon,
but every time i look at the code i spot something else that is wrong.

this line is meant to be more along the lines of

${echo} 1 > "${ROOTDIR}proc/syslogk 2>/dev/null

($echo is defined by the main loop, although im sceptical it is actually
used given echo is a builtin)

( i am writing from memory and there is another
"redirection" that is even worse thsn this one so i may be misremebering)


... i will include some code to remove the "1" -.didnt think of this!

but at least you confirmed that this test was never working as intended!

At least in the BaSH functions and aliases supersede builtins, although
I'm not sure about what the POSIX standard says about it.

At least in the BaSH functions and aliases supersede builtins, although
I'm not sure about what the POSIX standard says about it.

We believe that the bug you reported is fixed in the latest version of
chkrootkit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1032122@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Richard Lewis <richard.lewis.debian@googlemail.com> (supplier of updated chkrootkit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 12 Mar 2023 12:31:00 +0100
Source: chkrootkit
Architecture: source
Version: 0.57-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Security Tools <team+pkg-security@tracker.debian.org>
Changed-By: Richard Lewis <richard.lewis.debian@googlemail.com>
Closes: 589682 745433 1019460 1032122
Changes:
 chkrootkit (0.57-2) unstable; urgency=medium
 .
   [ Richard Lewis ]
   * Team upload
   * Fix several tests that did not work, contained syntax errors or
      where the output did not make clear what had been found
      (and remove spurious file in /usr/lib/chkrootkit/1 created as a result,
      thanks to Thomas Dorner)
      (Closes: #1032122, #589682)
   * Update autopkgtests to avoid warnings from grep (Thanks to Seb35)
      (Closes: #1019460)
   * Add systemd timer (Closes: #745433 as you can change the time the unit runs)
   * Add NEWS.Debian to document disabled tests
   * All lintian warnings are now fixed or overridden
Checksums-Sha1:
 dd089edd999ace2c8c19d21fe7e1ca77df8d7f84 2003 chkrootkit_0.57-2.dsc
 6917871a9301e5b060084807435d1482adf5a0ce 74268 chkrootkit_0.57-2.debian.tar.xz
 155ded14edcfdd5ab8495be34cda5999ded0a6cc 6538 chkrootkit_0.57-2_source.buildinfo
Checksums-Sha256:
 4629a9bbbcedcac0028380402cf7b1820bab5a0bcd3341acd2476b2160ba97f8 2003 chkrootkit_0.57-2.dsc
 95f302950cca5b04eac4f67b5aec3d0628a8e9bd4abac4465b11a2902efdaac7 74268 chkrootkit_0.57-2.debian.tar.xz
 1d6382ad79eb3012ecf50f4c9f058de01ceb710b0a299117edb78af2164fa4ec 6538 chkrootkit_0.57-2_source.buildinfo
Files:
 54e0ce7537dba4a9a7d7a58853dbaf8f 2003 misc optional chkrootkit_0.57-2.dsc
 271ea463b479f2809b0985b908f930f8 74268 misc optional chkrootkit_0.57-2.debian.tar.xz
 2a869d123a4323f996e87e60748e0446 6538 misc optional chkrootkit_0.57-2_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEfLiv/VYDL+NaNH0uasy9D6O3RHwFAmQbgLEACgkQasy9D6O3
RHyNpQ//fD0oGonp5STvP7kjgGJF/6fM3ZyfN7Q8BSkVTHGtPsKfGawPHS4KEyCw
cjfrwpJOZXRjq+hKmLQxJl4wzgHRiePJWs/UCzCesYHCRA0MKPtk3vyb0O6La6oo
9Kb+eI5ZdfOxQj3BshGM0Y0QRsnQ43oFTOBSerPfPtpNdnpgEaWktF/7wE5nlhuX
gBOWivt7bI+p2YILTRJ7/I91Wz2gSCoTOGib12nBVW5bZ5EiFCkKSGr9oYvgHCJ6
fI0UrboxJnxXmFRdoSuiod4fDeGkOEmE2VylJ+bIsBuYVFFh8EU8PnY0iVQ4P0y1
8gAte9al16nntpAigdUdEyeHlEKkWUeNKBOsOaE8HwoDZfxvi5m7nNhbL91Uod3F
t/RtqJfMWyIcKS1Ad/1TVbU5PDuGLknmP2eQfH73N+YljaNNMiuX2C2DsdPSZZXl
ewA14DjAk6dkgDKnGPRPfonmYCZRum0/iPO8worczKfgmzweyL5G+jtOwOAI+vTB
U9rETJMeHJiXcYS9MOapYULutx6IZfvmNC+YOb54vKDVXF4jskXmCPby8p4k7t7+
1DLiU1f5bCtmLjSvO0GpTWEpLfjF/nL5I3UEQg1IGuC0PenhNRQg1N288xmsJRI2
5U7QBeRPg8xGt8q1ea3ldnheDlz37/a2mnlbkqMoBqsa7WMCmFM=
=bKCM
-----END PGP SIGNATURE-----