#1119116 chkrootkit: false alert due to spurious "No such file or directory" from /usr/bin/find

Package:
chkrootkit
Source:
chkrootkit
Description:
rootkit detector
Submitter:
Vincent Lefevre
Date:
2025-10-27 01:35:03 UTC
Severity:
normal
#1119116#5
Date:
2025-10-27 01:33:25 UTC
From:
To:
I got the following alert:
chkrootkit output was not as expected.

The difference is:
--- [ BEGIN: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] ---
--- /var/log/chkrootkit/log.expected    2024-11-24 18:41:09.278624066 +0100
+++ /var/log/chkrootkit/log.today       2025-10-27 00:00:50.680156479 +0100
@@ -144,7 +144,8 @@
 Searching for RotaJakiro backdoor rootkit...                not found
 Searching for Syslogk LKM rootkit...                        not found
 Searching for Kovid LKM rootkit...                          not tested
-Searching for suspect PHP files...                          not found
+Searching for suspect PHP files...                          /usr/bin/find: ‘/var/tmp/systemd-private-f40df39b74cd464c8f5ac59a4648f5a6-logrotate.service-gDYDJi’: No such file or directory
+not found
 Searching for zero-size shell history files...              not tested
 Searching for hardlinked shell history files...             not tested
 Checking `aliens'...                                        finished
--- [ END: diff -u /var/log/chkrootkit/log.expected /var/log/chkrootkit/log.today ] ---

To update the expected output, run (as root)
#  cp -a -f /var/log/chkrootkit/log.today /var/log/chkrootkit/log.expected
# (note that unedited output is in /var/log/chkrootkit/log.today.raw)
------------------------------------------------------------------------

"No such file or directory" warnings from /usr/bin/find should be
filtered out.