#1111306 tiger: Tiger_DPKG_Optimize=Y does not support usrmerge

Package:
tiger
Source:
tiger
Description:
security auditing and intrusion detection tools for Linux
Submitter:
Francois Marier
Date:
2026-10-04 17:51:01 UTC
Severity:
normal
Tags:
#1111306#5
Date:
2025-08-16 16:06:04 UTC
From:
To:
On a usrmerged system (now the default), tiger outputs spurious messages
like these:

  NEW: --WARN-- [lin001w] File `/bin/apt-get' does not belong to any package.
  NEW: --WARN-- [lin001w] File `/bin/chsh' does not belong to any package.
  NEW: --WARN-- [lin001w] File `/bin/cut' does not belong to any package.

I suspect the optimization isn't usrmerge-aware because the "non-optimized"
version which uses dpkg directly works just fine.

Francois

#1111306#10
Date:
2026-10-04 17:49:29 UTC
From:
To:
The attached patch, against 1:3.2.4~rc1-3.5, fixes the check itself rather
than turning Tiger_DPKG_Optimize off.

Two things went wrong on a merged-/usr system:

1. deb_nopackfiles tests "[ ! -L $dir ]" with dirlist entries like "/bin/".
With the trailing slash the test follows the symlink, so /bin, /sbin and
/lib were scanned as well, and /lib brought in all of /usr/lib, which the
check deliberately leaves out. On a Linux Mint 22.3 desktop that was 33,230
lin001w warnings.

2. dpkg records some files under /bin and others under /usr/bin, so a path
found under /usr/bin can be listed under /bin in the .list file. The
optimised lookup now rewrites both the package lists and the diversions to
the /usr form (only when /bin, /sbin, /lib are symlinks), and the dpkg -S
path retries without /usr.

Tested in fresh debian:sid, debian:stable and ubuntu:24.04 containers with
one binary modified, one deleted and one stray file added to /usr/sbin:
before, 3,210 lin001w warnings; after, two (the stray file and Docker's own
/usr/sbin/policy-rc.d). The patch is for systems/Linux/2; Linux/3 and
Linux/4 are copies of it in the Debian source.

Andrei Trimbitas
--- a/systems/Linux/2/deb_nopackfiles
+++ b/systems/Linux/2/deb_nopackfiles
@@ -17,6 +17,11 @@
#
# Linux/deb_nopackfiles - 23/08/2001
#
+# 10/04/2026 - atrimbitas - Support merged-/usr systems (Debian bug
#1111306).
+# Test the directory itself for a symlink, since '/bin/' with
+# a trailing slash resolves the link and /lib then pulled in
+# all of /usr/lib. dpkg may record a file under /bin, /sbin or
+# /lib or under /usr, so both forms count as owned.
# 05/07/2006 - jfs - Skip directories that are symbolic links, this happens
# with /usr/X11R6/bin as the latest Xorg package
# versions just symlink this to /usr/bin/ (Debian bug #367931)
@@ -45,7 +50,7 @@
# - Consider the use of 'dlocate' which will be faster than DPKG. Notice
# however that it's priority "optional"
# dlocate could be faster
-# DLOCATE=`which dlocate`
+# DLOCATE=`command -v dlocate`
# DLOCATE=${DLOCATE:-$DPKG}
#
#-----------------------------------------------------------------------------
@@ -108,8 +113,8 @@
haveallcmds DPKG || exit 1
fi