Description of problem:
The output of msec weekly on my Mageia 2 system (fully updated) signals
Chkrootkit check: failed
and, amongst other messages - farther down
Searching for Suckit rootkit... Warning: /sbin/init INFECTED
That sounds quite alarming - but, in Redhat, is considered as a "false positive": a corresponding bug exists in Redhat since December 2010, https://bugzilla.redhat.com/show_bug.cgi?id=636231 - not resolved, but the ticket has been quite active.
If this bug cannot be fixed with a reasonable effort, Mageia should at least disable the corresponding test in chkrootkit in order to keep the output of msec meaningful.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Run msec weekly (unless a weekly report exists already)
2. In the output, search for SUCKIT
ennael1, stormiSource RPM:
Created attachment 4348 [details]
Patch to remove check for the string HOME in /sbin/init.
Created attachment 4349 [details]
Patch to remove check for string HOME in /sbin/init
Fixing a typo in the comment
Attachment 4348 is obsolete:
Fixed in Cauldron in chkrootkit-0.49-7.mga4.
Technically it wouldn't be appropriate to backport this to Mageia 2, since sysvinit is still supported there. It could be backported to Mageia 3.
Ping. Can someone fix this for Mageia 3?
Fixed by the update in Bug 13481: