Home / server / Questions / 548404
Accepted
rubo77
Asked: 2013-10-25 08:35:35 +0800 CST

Suspicious file types found in /dev ASCII text

  • 772

rkhunter complains about this:

Warning: Suspicious file types found in /dev:
         /dev/.udev/queue.bin: data
         /dev/.udev/data/c13:66: ASCII text
         /dev/.udev/data/c13:64: ASCII text
         /dev/.udev/data/c13:65: ASCII text
         /dev/.udev/data/c13:67: ASCII text
         /dev/.udev/data/+input:input2: ASCII text
         /dev/.udev/data/+input:input1: ASCII text
         /dev/.udev/data/+input:input3: ASCII text
         /dev/.udev/data/+input:input0: ASCII text
         /dev/.udev/data/b9:1: ASCII text
         /dev/.udev/data/b9:2: ASCII text
         /dev/.udev/data/b9:0: ASCII text
         /dev/.udev/data/c116:2: ASCII text
         /dev/.udev/data/b7:7: ASCII text
         /dev/.udev/data/b7:6: ASCII text
         /dev/.udev/data/b7:5: ASCII text
         /dev/.udev/data/b7:4: ASCII text
         /dev/.udev/data/b7:3: ASCII text
         /dev/.udev/data/b7:2: ASCII text
         /dev/.udev/data/b7:1: ASCII text
         /dev/.udev/data/b7:0: ASCII text
         /dev/.udev/data/+serio:serio0: ASCII text
         /dev/.udev/data/c189:0: ASCII text
         /dev/.udev/data/c189:512: ASCII text
         /dev/.udev/data/c189:384: ASCII text
         /dev/.udev/data/c189:256: ASCII text
         /dev/.udev/data/c189:128: ASCII text
         /dev/.udev/data/b8:19: ASCII text
         /dev/.udev/data/b8:18: ASCII text
         /dev/.udev/data/b8:17: ASCII text
         /dev/.udev/data/b8:16: ASCII text
         /dev/.udev/data/b8:3: ASCII text
         /dev/.udev/data/b8:2: ASCII text
         /dev/.udev/data/b8:1: ASCII text
         /dev/.udev/data/b8:0: ASCII text
         /dev/.udev/data/n2: ASCII text
         /dev/.udev/data/c226:0: ASCII text
         /dev/.udev/rules.d/61-dev-root-link.rules: ASCII text
         /dev/.mdadm/map: ASCII text

why is this happening since the upgrade to debian wheezy?

And why would it be bad, that they are ascii?

rootkit

1 Answers

  1. Best Answer

    This is a false positive. Check this page.

    A result of that change is, that udev no longer uses /dev/ to store its runtime state file, i.e. the /dev/.udev/ directory, /dev/.udevdb and /dev/.udev.tdb are gone and udev uses /run/udev/ now.

    • 3