Home / ubuntu / Questions / 1178765
Accepted
ElToro1966
Asked: 2019-10-05 10:05:13 +0800 CST

chkrootkit false positives?

  • 772

I've just run chkrootkit on my laptop running Ubuntu 18.04 LTS, and everything is in the clear except the following:

    Searching for suspicious files and dirs, it may take a while... 
The following suspicious files and directories were found: 
/usr/lib/jvm/.java-1.11.0-openjdk-amd64.jinfo /usr/lib/debug/.build-id 
/usr/lib/rstudio/www/.gitignore 
/usr/lib/rstudio/resources/templates/.gitignore 
/lib/modules/5.0.0-27-generic/vdso/.build-id 
/lib/modules/5.0.0-29-generic/vdso/.build-id
/usr/lib/debug/.build-id 
/lib/modules/5.0.0-27-generic/vdso/.build-id 
/lib/modules/5.0.0-29-generic/vdso/.build-id

Are any or all of these warnings false positives? I have done a fairly thorough search for each warning and come up empty. Any help would be much appreciated.

security 18.04 rstudio chkrootkit

1 Answers

  1. Best Answer

    Those files are tagged "suspicious", because they're "hidden" (that is, their names begin with a dot). Inspect them with ls -Adl and less. Use dpkg -S to see if the files/dirs belong to a package.

    • 1