WARNING: The following suspicious files and directories were found:
/usr/lib/libreoffice/share/.registry [From Debian package: libreoffice-common]

i.e. dot-files are suspicious.

severity 1109692 minor

retitle 1109692 libreoffice-common: chkrootkit complains about /usr/lib/libreoffice/share/.registry

thanks


Hi,

Am 22.07.25 um 07:37 schrieb Martin-Éric Racine

Then don't run it. Or use it with a grain of salt.


That one is the "source" of which the real main.xcd in registry is created for by ucf. See libreoffice-commons maintainer scripts:

# Automatically added by dh_ucf/13.24.2
if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ]; then
         ucf --three-way "/usr/lib/libreoffice/share/.registry/main.xcd" "/etc/libreoffice/registry/main.xcd"
         ucfr --force libreoffice-common "/etc/libreoffice/registry/main.xcd"
fi

It's hidden because it's supposed to be hidden because it's not supposed to be touched by users. (and registry/ is taken anyway.) I could have choosen registry-original but that would be too visible, IMHO.


Regards,


Rene

ti 22.7.2025 klo 8.57 Rene Engelhard (rene@debian.org) kirjoitti:

Or don't make changes to the packaging that suddenly make chkrootkit complain.

Files in /usr/ are not meant to be touched by users anyhow. As such,
there is no need to obfuscate this.

Martin-Éric

Control: reassign -1 chkrootkit

This directory was already shipped in bullseye and maybe earlier.

chkrootkit had enough time to update its rules.

Chris

Chris Hofstaedtler <zeha@debian.org> writes:

chkrootkit does not maintain a list of all "things which might be
suspicious but arnt", there are too many possibilities: "use it with a
gran of salt" is the only way things like that can work for everyone.

instead it provides several ways to filter results or hide things from
the results. See /usr/share/doc/chkrootkit/README.FALSE-POSITIVES.gz