summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRobin H. Johnson <robbat2@gentoo.org>2015-08-08 13:49:04 -0700
committerRobin H. Johnson <robbat2@gentoo.org>2015-08-08 17:38:18 -0700
commit56bd759df1d0c750a065b8c845e93d5dfa6b549d (patch)
tree3f91093cdb475e565ae857f1c5a7fd339e2d781e /app-forensics/chkrootkit
downloadgentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.tar.gz
gentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.tar.bz2
gentoo-56bd759df1d0c750a065b8c845e93d5dfa6b549d.zip
proj/gentoo: Initial commit
This commit represents a new era for Gentoo: Storing the gentoo-x86 tree in Git, as converted from CVS. This commit is the start of the NEW history. Any historical data is intended to be grafted onto this point. Creation process: 1. Take final CVS checkout snapshot 2. Remove ALL ChangeLog* files 3. Transform all Manifests to thin 4. Remove empty Manifests 5. Convert all stale $Header$/$Id$ CVS keywords to non-expanded Git $Id$ 5.1. Do not touch files with -kb/-ko keyword flags. Signed-off-by: Robin H. Johnson <robbat2@gentoo.org> X-Thanks: Alec Warner <antarus@gentoo.org> - did the GSoC 2006 migration tests X-Thanks: Robin H. Johnson <robbat2@gentoo.org> - infra guy, herding this project X-Thanks: Nguyen Thai Ngoc Duy <pclouds@gentoo.org> - Former Gentoo developer, wrote Git features for the migration X-Thanks: Brian Harring <ferringb@gentoo.org> - wrote much python to improve cvs2svn X-Thanks: Rich Freeman <rich0@gentoo.org> - validation scripts X-Thanks: Patrick Lauer <patrick@gentoo.org> - Gentoo dev, running new 2014 work in migration X-Thanks: Michał Górny <mgorny@gentoo.org> - scripts, QA, nagging X-Thanks: All of other Gentoo developers - many ideas and lots of paint on the bikeshed
Diffstat (limited to 'app-forensics/chkrootkit')
-rw-r--r--app-forensics/chkrootkit/Manifest4
-rw-r--r--app-forensics/chkrootkit/chkrootkit-0.48-r1.ebuild48
-rw-r--r--app-forensics/chkrootkit/chkrootkit-0.49.ebuild52
-rw-r--r--app-forensics/chkrootkit/files/chkrootkit-0.48-chkutmp.c-some-overruns-fixes.patch57
-rw-r--r--app-forensics/chkrootkit/files/chkrootkit-0.48-shell-history-anomalies.diff21
-rw-r--r--app-forensics/chkrootkit/files/chkrootkit.cron6
-rw-r--r--app-forensics/chkrootkit/metadata.xml8
7 files changed, 196 insertions, 0 deletions
diff --git a/app-forensics/chkrootkit/Manifest b/app-forensics/chkrootkit/Manifest
new file mode 100644
index 000000000000..e54ddf4adfc4
--- /dev/null
+++ b/app-forensics/chkrootkit/Manifest
@@ -0,0 +1,4 @@
+DIST chkrootkit-0.48-gentoo.diff.bz2 4534 SHA256 af7cdac03a2357615e6a6973c8f892b7541912e05c90b4e876eb1c0c8976d7dc SHA512 926c6913cc9a13f5578070e48301c6f3ff026d3f4df236dcf4b53e092ba4ba288f7d77fa8d8c7268e0e3c21921ae20b4027898e872c59a0cb1c451961bf862fb WHIRLPOOL b836f0846d5dbdcfb1a17f89328be62428107789b463537b0eb4daf9547771c6227d3caa37921a6030ae949ed1fbcb5dd38a24b98c4f08e7148218e304df5ece
+DIST chkrootkit-0.48.tar.gz 38323 SHA256 b4b3d3540a7022aa7a81cae93f28c8475bc2660a21f88126725624c09769f1fb SHA512 df0348a1abd70ff905979ecead1e99b3fef1d706062112e3461e1e6b76e490e36466d46d254a02a2033e67e9774cfeb44ebff29fcc62a217e7a0e7843a239a24 WHIRLPOOL 76f9986dc0291789d16ae4ab1adb8c24b53c1013ad0984f9efe706aa52d0fb539ffc636ad738e3bc347081efad8f20c888d58cbb6a9619a540e9b383f7cd59ef
+DIST chkrootkit-0.49-gentoo.diff.bz2 5472 SHA256 85a01c8bb159420fc7681b5f3ec6529bc69cf10b3484daee0a5c126ef4a7b5d8 SHA512 4121d09f7bb6ad7d3f2ed42c914087f4724877def3c591fd6b7fa8e2b2b23a1b32b1bb1ba94dc079914c967d2483ebd614582b13afb4c1c801701a58ada89b62 WHIRLPOOL 25df5424700c72d19201faf6555790b04b878af3ef185f52f44807e018701926cd9e8d112343b86168ad6688df8fffcc2829c11886d8f628b03ff7f63f1ac7d0
+DIST chkrootkit-0.49.tar.gz 39421 SHA256 ccb87be09e8923d51f450a167f484414f70c36c942f8ef5b9e5e4a69b7baa17f SHA512 b796547fc483635ff6ee4e953f7dda34913189459de05b547522b79f8edeef5adae72cc05515b8ff9382cbabffd93cae7d114a40636e14c55da513bb42b05909 WHIRLPOOL c94f96f185ae5f5dd038a7b2ffd9603ee8c0f2fcbaeb3eb73d20260898f1677a2c1aad5cd6a257b29ca540d02916dca59434ff10b807567447889cf23f65b25e
diff --git a/app-forensics/chkrootkit/chkrootkit-0.48-r1.ebuild b/app-forensics/chkrootkit/chkrootkit-0.48-r1.ebuild
new file mode 100644
index 000000000000..e6bd4434106c
--- /dev/null
+++ b/app-forensics/chkrootkit/chkrootkit-0.48-r1.ebuild
@@ -0,0 +1,48 @@
+# Copyright 1999-2010 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+inherit eutils toolchain-funcs
+
+DESCRIPTION="a tool to locally check for signs of a rootkit"
+HOMEPAGE="http://www.chkrootkit.org/"
+SRC_URI="ftp://ftp.pangeia.com.br/pub/seg/pac/${P}.tar.gz
+ mirror://gentoo/${P}-gentoo.diff.bz2"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="alpha amd64 arm hppa ia64 ~mips ppc ppc64 s390 sh sparc x86"
+IUSE=""
+
+src_unpack() {
+ unpack ${A}
+ cd "${S}"
+
+ epatch "${WORKDIR}/${P}-gentoo.diff"
+ epatch "${FILESDIR}/${P}-shell-history-anomalies.diff"
+ epatch "${FILESDIR}/${P}-chkutmp.c-some-overruns-fixes.patch"
+ sed -i 's:/var/adm/:/var/log/:g' chklastlog.c || die "sed chklastlog.c failed"
+}
+
+src_compile() {
+ emake CC=$(tc-getCC) STRIP=true sense || die "emake sense failed"
+}
+
+src_install() {
+ dosbin chkdirs chklastlog chkproc chkrootkit chkwtmp chkutmp ifpromisc \
+ strings-static || die
+ dodoc ACKNOWLEDGMENTS README*
+
+ exeinto /etc/cron.weekly
+ newexe "${FILESDIR}"/${PN}.cron ${PN} || die
+}
+
+pkg_postinst() {
+ echo
+ elog "Edit /etc/cron.weekly/chkrootkit to activate chkrootkit!"
+ elog
+ elog "Some applications, such as portsentry, will cause chkrootkit"
+ elog "to produce false positives. Read the chkrootkit FAQ at"
+ elog "http://www.chkrootkit.org/ for more information."
+ echo
+}
diff --git a/app-forensics/chkrootkit/chkrootkit-0.49.ebuild b/app-forensics/chkrootkit/chkrootkit-0.49.ebuild
new file mode 100644
index 000000000000..9d2a7fcd67f4
--- /dev/null
+++ b/app-forensics/chkrootkit/chkrootkit-0.49.ebuild
@@ -0,0 +1,52 @@
+# Copyright 1999-2012 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Id$
+
+EAPI="4"
+
+inherit eutils toolchain-funcs
+
+DESCRIPTION="Tool to locally check for signs of a rootkit"
+HOMEPAGE="http://www.chkrootkit.org/"
+SRC_URI="ftp://ftp.pangeia.com.br/pub/seg/pac/${P}.tar.gz
+ mirror://gentoo/${P}-gentoo.diff.bz2"
+
+LICENSE="BSD-2"
+SLOT="0"
+KEYWORDS="alpha amd64 arm hppa ia64 ~mips ppc ppc64 s390 sh sparc x86"
+IUSE="+cron"
+
+RDEPEND="cron? ( virtual/cron )"
+
+src_prepare() {
+ epatch "${WORKDIR}"/${P}-gentoo.diff
+ sed -i 's:/var/adm/:/var/log/:g' chklastlog.c || die "sed chklastlog.c failed"
+}
+
+src_compile() {
+ emake CC="$(tc-getCC)" STRIP=true sense
+}
+
+src_install() {
+ dosbin chkdirs chklastlog chkproc chkrootkit chkwtmp chkutmp ifpromisc strings-static
+ dodoc ACKNOWLEDGMENTS README*
+
+ if use cron ; then
+ exeinto /etc/cron.weekly
+ newexe "${FILESDIR}"/${PN}.cron ${PN}
+ fi
+}
+
+pkg_postinst() {
+ if use cron ; then
+ elog
+ elog "Edit /etc/cron.weekly/chkrootkit to activate chkrootkit!"
+ elog
+ fi
+
+ elog
+ elog "Some applications, such as portsentry, will cause chkrootkit"
+ elog "to produce false positives. Read the chkrootkit FAQ at"
+ elog "http://www.chkrootkit.org/ for more information."
+ elog
+}
diff --git a/app-forensics/chkrootkit/files/chkrootkit-0.48-chkutmp.c-some-overruns-fixes.patch b/app-forensics/chkrootkit/files/chkrootkit-0.48-chkutmp.c-some-overruns-fixes.patch
new file mode 100644
index 000000000000..09ba065a0697
--- /dev/null
+++ b/app-forensics/chkrootkit/files/chkrootkit-0.48-chkutmp.c-some-overruns-fixes.patch
@@ -0,0 +1,57 @@
+=== modified file 'chkutmp.c'
+--- chkutmp.c 2008-10-06 19:07:51 +0000
++++ chkutmp.c 2007-10-20 07:56:19 +0000
+@@ -23,6 +23,7 @@
+ *
+ * Changelog:
+ * Ighighi X - Improved speed via break command - 2005/03/27
++ * Stewart Gebbie - fixed buffer overrun bug related to MAXREAD and UT_PIDLENGTH - 2007-10-20
+ *
+ */
+
+@@ -42,7 +43,7 @@
+ #endif
+ #include <ctype.h>
+
+-#define MAXREAD 1024
++#define MAXREAD 4096
+ #define MAXBUF 4096
+ #define MAXLENGTH 256
+ #define UT_PIDSIZE 12
+@@ -57,13 +58,13 @@
+ #endif
+
+ struct ps_line {
+- char ps_tty[UT_LINESIZE];
+- char ps_user[UT_NAMESIZE];
+- char ps_args[MAXLENGTH];
++ char ps_tty[UT_LINESIZE+1];
++ char ps_user[UT_NAMESIZE+1];
++ char ps_args[MAXLENGTH+1];
+ int ps_pid;
+ };
+ struct utmp_line {
+- char ut_tty[UT_LINESIZE];
++ char ut_tty[UT_LINESIZE+1];
+ int ut_pid;
+ int ut_type;
+ };
+@@ -77,7 +78,7 @@
+ int fetchps(struct ps_line *psl_p)
+ {
+ FILE *ps_fp;
+- char line[MAXREAD + 1], pid[UT_PIDSIZE];
++ char line[MAXREAD + 1], pid[UT_PIDSIZE+1];
+ char *s, *d;
+ struct ps_line *curp = &psl_p[0];
+ struct ps_line *endp = &psl_p[MAXBUF];
+@@ -97,7 +98,7 @@
+ while (isspace(*s)) /* skip spaces */
+ s++;
+ d = pid;
+- for (x = 0; (!isspace(*s)) && (*d++ = *s++) && x <= UT_LINESIZE; x++) /* grab pid */
++ for (x = 0; (!isspace(*s)) && (*d++ = *s++) && x <= UT_PIDSIZE; x++) /* grab pid */
+ ;
+ *d = '\0';
+ curp->ps_pid = atoi(pid);
+
diff --git a/app-forensics/chkrootkit/files/chkrootkit-0.48-shell-history-anomalies.diff b/app-forensics/chkrootkit/files/chkrootkit-0.48-shell-history-anomalies.diff
new file mode 100644
index 000000000000..b0a5615d7264
--- /dev/null
+++ b/app-forensics/chkrootkit/files/chkrootkit-0.48-shell-history-anomalies.diff
@@ -0,0 +1,21 @@
+http://bugs.gentoo.org/show_bug.cgi?id=226067
+
+*** a/chkrootkit Thu Jun 12 15:20:01 2008
+--- b/chkrootkit Thu Jun 12 15:28:09 2008
+***************
+*** 1098,1104 ****
+ echo "Warning: \`${files}' file size is zero"
+ files1=`${find} ${ROOTDIR}${HOME} ${findargs} -name '.*history' \( -links 2 -o -type l \)`
+ [ ! -z "${files1}" ] && \
+! echo "Warning: \`${files}' is linked to another file"
+ fi
+ if [ -z "${files}" -a -z "${files1}" ]; then
+ if [ "${QUIET}" != "t" ]; then echo "nothing found"; fi
+--- 1098,1104 ----
+ echo "Warning: \`${files}' file size is zero"
+ files1=`${find} ${ROOTDIR}${HOME} ${findargs} -name '.*history' \( -links 2 -o -type l \)`
+ [ ! -z "${files1}" ] && \
+! echo "Warning: \`${files1}' is linked to another file"
+ fi
+ if [ -z "${files}" -a -z "${files1}" ]; then
+ if [ "${QUIET}" != "t" ]; then echo "nothing found"; fi
diff --git a/app-forensics/chkrootkit/files/chkrootkit.cron b/app-forensics/chkrootkit/files/chkrootkit.cron
new file mode 100644
index 000000000000..9f7eb17b13b1
--- /dev/null
+++ b/app-forensics/chkrootkit/files/chkrootkit.cron
@@ -0,0 +1,6 @@
+#!/bin/sh
+#
+# uncomment this to make it work
+#
+
+#exec /usr/sbin/chkrootkit -q
diff --git a/app-forensics/chkrootkit/metadata.xml b/app-forensics/chkrootkit/metadata.xml
new file mode 100644
index 000000000000..710ea088e6a5
--- /dev/null
+++ b/app-forensics/chkrootkit/metadata.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "http://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+ <herd>forensics</herd>
+ <use>
+ <flag name="cron">Install cron script for weekly rootkit scans</flag>
+ </use>
+</pkgmetadata>