--- /home/kevin/rkhunter.spec.old 2008-02-03 18:43:06.000000000 -0700 +++ rkhunter.spec 2008-02-03 18:32:58.000000000 -0700 @@ -1,81 +1,56 @@ -%define rkhVer 1.2.8 -%define rpmRel 3 - -# We can't let RPM do the dependencies automatic because it'll then pick up -# a correct but undesirable perl dependency, which rkhunter does not require -# in order to function properly [perl(Digest::MD5) & perl(Digest::SHA1)]. -AutoReqProv: no - Name: rkhunter -Version: %{rkhVer} -Release: %{rpmRel}%{?dist} +Version: 1.3.0 +Release: 1%{?dist} Summary: A host-based tool to scan for rootkits, backdoors and local exploits Group: Applications/System -License: GPL -URL: http://www.rootkit.nl/ -Source0: http://downloads.rootkit.nl/rkhunter-1.2.8.tar.gz -Source1: rkhunter-auto_scan.tar.gz -Source2: rkhunter-%{rkhVer}-%{rpmRel}.src.sha -Patch0: rkhunter-1.2.8-default_settings-conf.patch -Patch1: rkhunter-1.1.8-showfiles.patch -Patch2: rkhunter-1.1.9-shared_man_search.patch -Patch3: rkhunter-1.2.8-app_check_default.patch -Patch4: rkhunter-1.2.7-datestamp.patch -Patch5: rkhunter-1.2.7-append_log.patch -Patch6: rkhunter-1.2.7-group_log.patch -Patch7: rkhunter-1.2.7-manpage.patch +License: GPLv2+ +URL: http://rkhunter.sourceforge.net/ +Source0: http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.0.tar.gz +Source1: http://downloads.sourceforge.net/rkhunter/rkhunter-1.3.0.sha1 +Source2: 01-rkhunter +Source3: rkhunter.sysconfig BuildArch: noarch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) -Requires: /bin/sh, coreutils, binutils, modutils, findutils, grep, mktemp +Requires: coreutils, binutils, modutils, findutils, grep, mktemp Requires: e2fsprogs, procps, lsof, prelink, iproute, net-tools, wget -Requires: perl, perl(strict), perl(IO::Socket), mailx +Requires: perl, perl(strict), perl(IO::Socket), mailx, logrotate %description -Rootkit Hunter scans files and systems for known and unknown rootkits, -backdoors, and sniffers. The package contains one shell script, a few -text-based databases, and optional Perl modules. It should run on almost -every Unix clone. This tool scans for rootkits, backdoors and local -exploits by running tests like: - - MD5 hash compare - - Look for default files used by rootkits - - Wrong file permissions for binaries - - Look for suspected strings in LKM and KLD modules - - Look for hidden files - - Optional scan within plaintext and binary files - - Software version checks - - Application tests - -Rootkit Hunter is released as a GPL licensed project and -is free for everyone to use. - +Rootkit Hunter (RKH) is an easy-to-use tool which checks +computers running UNIX (clones) for the presence of rootkits +and other unwanted tools. %prep -# This optional check is for verification of original sources -# DURING the binary build process (sha1 canary check) -#[ ! -e %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha.orig ] \ -# && %{__perl} -pi.orig -e ' -# s|../SOURCES|%{_sourcedir}|g; -# ' %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha -#sha1sum --check %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha || exit $? -#%{__rm} -f %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha -#%{__mv} %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha.orig \ -# %{_sourcedir}/%{name}-%{rkhVer}-%{rpmRel}.src.sha - -%setup -q -n %{name} -%setup -q -D -T -a 1 -n %{name} - -%patch0 -b .orig +%setup -q %{__perl} -pi.0001 -e ' - s|^#(INSTALLDIR=).+$|$1%{_prefix}|; s|^#(MAIL-ON-WARNING=).+$|$1root\@localhost|; s|^#(TMPDIR=).+$|$1%{_var}/%{name}/tmp|; s|^#(DBDIR=).+$|$1%{_var}/%{name}/db|; + s|^#(SCRIPTDIR=).+$|$1%{_datadir}/%{name}/scripts|; + s|^#(PKGMGR=).+$|$1RPM|; + s|^#(OS_VERSION_FILE=).+$|$1/etc/fedora-release|; + s|^#(ALLOWHIDDENDIR=).+$|$1/dev/.udev|; + s|^#(ALLOWHIDDENDIR=).+$|$1/usr/share/man/man1/..1.gz|; + s|^(APPEND_LOG=).+$|$11|; + s|^(ALLOW_SSH_ROOT_USER=).+$|$1yes|; + s|^(DISABLE_TESTS=).+$|$1"additional_rkts suspscan hidden_procs deleted_files packet_cap_apps"|; ' files/%{name}.conf +# Add Fedora specific configs +echo "INSTALLDIR=%{_prefix}" >> files/%{name}.conf +echo "SCRIPTWHITELIST=/usr/bin/whatis" >> files/%name.conf +echo "SCRIPTWHITELIST=/usr/bin/ldd" >> files/%name.conf +echo "SCRIPTWHITELIST=/usr/bin/groups" >> files/%name.conf +echo "SCRIPTWHITELIST=/usr/bin/GET" >> files/%name.conf +echo "SCRIPTWHITELIST=/sbin/ifup" >> files/%name.conf +echo "SCRIPTWHITELIST=/sbin/ifdown" >> files/%name.conf +# in f8/f9 +echo "SYSLOG_CONFIG_FILE=/etc/rsyslog.conf" >> files/%name.conf + %{__perl} -pi.orig -e ' s|\@TMPDIR\@|%{_var}/%{name}/tmp|g; s|\@STDIR\@|%{_localstatedir}|g; @@ -87,14 +62,6 @@ s|\@LGDIR\@|%{_localstatedir}/log|g; ' 01-%{name} -%patch1 -b .orig -%patch2 -b .orig -%patch3 -b .0001 -%patch4 -b .0002 -%patch5 -b .0003 -%patch6 -b .0004 -%patch7 -b .orig - %{__cat} <<'EOF' >%{name}.logrotate %{_localstatedir}/log/%{name}.log { weekly @@ -103,93 +70,74 @@ } EOF - %build -#%%configure -# We have nothing to configure... yet... - +# Nothing to be built %install %{__rm} -rf $RPM_BUILD_ROOT %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_bindir} %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_sysconfdir}/{cron.daily,sysconfig,logrotate.d} -%{__mkdir} -m750 -p ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version} %{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_mandir}/man8 -%{__mkdir} -m750 -p ${RPM_BUILD_ROOT}%{_var}/%{name}/{db,tmp} +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/%{name}/{db,tmp} +%{__mkdir} -m755 -p ${RPM_BUILD_ROOT}%{_var}/%{name}/db/i18n -%{__install} -m750 -p files/%{name} ${RPM_BUILD_ROOT}%{_bindir}/ +%{__install} -m755 -p files/%{name} ${RPM_BUILD_ROOT}%{_bindir}/ -%{__install} -m640 -p files/backdoorports.dat ${RPM_BUILD_ROOT}%{_var}/%{name}/db/ -%{__install} -m640 -p files/defaulthashes.dat ${RPM_BUILD_ROOT}%{_var}/%{name}/db/ -%{__install} -m640 -p files/md5blacklist.dat ${RPM_BUILD_ROOT}%{_var}/%{name}/db/ -%{__install} -m640 -p files/mirrors.dat ${RPM_BUILD_ROOT}%{_var}/%{name}/db/ -%{__install} -m640 -p files/os.dat ${RPM_BUILD_ROOT}%{_var}/%{name}/db/ -%{__install} -m640 -p files/programs_bad.dat ${RPM_BUILD_ROOT}%{_var}/%{name}/db/ -%{__install} -m640 -p files/programs_good.dat ${RPM_BUILD_ROOT}%{_var}/%{name}/db/ +%{__install} -m644 -p files/backdoorports.dat ${RPM_BUILD_ROOT}%{_var}/%{name}/db/ +%{__install} -m644 -p files/defaulthashes.dat ${RPM_BUILD_ROOT}%{_var}/%{name}/db/ +%{__install} -m644 -p files/md5blacklist.dat ${RPM_BUILD_ROOT}%{_var}/%{name}/db/ +%{__install} -m644 -p files/mirrors.dat ${RPM_BUILD_ROOT}%{_var}/%{name}/db/ +%{__install} -m644 -p files/os.dat ${RPM_BUILD_ROOT}%{_var}/%{name}/db/ +%{__install} -m644 -p files/programs_bad.dat ${RPM_BUILD_ROOT}%{_var}/%{name}/db/ +%{__install} -m644 -p files/programs_good.dat ${RPM_BUILD_ROOT}%{_var}/%{name}/db/ +%{__install} -m644 -p files/i18n/cn ${RPM_BUILD_ROOT}%{_var}/%{name}/db/i18n/ +%{__install} -m644 -p files/i18n/en ${RPM_BUILD_ROOT}%{_var}/%{name}/db/i18n/ %{__install} -m644 -p files/CHANGELOG ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/ %{__install} -m644 -p files/LICENSE ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/ %{__install} -m644 -p files/README ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/ %{__install} -m644 -p files/WISHLIST ${RPM_BUILD_ROOT}%{_docdir}/%{name}-%{version}/ - -%{__install} -m644 -p files/development/*.8 ${RPM_BUILD_ROOT}%{_mandir}/man8/ - -%{__install} -m750 -p files/check_modules.pl ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/ -%{__install} -m750 -p files/check_port.pl ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/ -%{__install} -m750 -p files/check_update.sh ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/ -%{__install} -m750 -p files/filehashmd5.pl ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/ -%{__install} -m750 -p files/filehashsha1.pl ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/ -%{__install} -m750 -p files/showfiles.pl ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/ -%{__install} -m750 -p 01-%{name} ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/ +%{__install} -m755 -p files/check_modules.pl ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/ +%{__install} -m755 -p files/check_port.pl ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/ +%{__install} -m755 -p files/check_update.sh ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/ +%{__install} -m644 -p files/*.8 ${RPM_BUILD_ROOT}%{_mandir}/man8/ +# Don't ship these unless we want to Require the perl modules +#%{__install} -m750 -p files/filehashmd5.pl ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/ +#%{__install} -m750 -p files/filehashsha1.pl ${RPM_BUILD_ROOT}%{_prefix}/lib/%{name}/scripts/ +%{__install} -m755 -p files/showfiles.pl ${RPM_BUILD_ROOT}%{_datadir}/%{name}/scripts/ +%{__install} -m755 -p %{SOURCE2} ${RPM_BUILD_ROOT}%{_sysconfdir}/cron.daily/ %{__install} -m644 -p %{name}.logrotate ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/%{name} %{__install} -m640 -p files/%{name}.conf ${RPM_BUILD_ROOT}%{_sysconfdir}/ -%{__install} -m640 -p %{name}.sysconfig ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name} - +%{__install} -m640 -p %{SOURCE3} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/%{name} %clean %{__rm} -rf $RPM_BUILD_ROOT -# Autoclean for rpmbuild -bb -#cd .. -#[ ! -d %{name} ] || %{__rm} -rf %{name} - - -%post -/bin/touch %{_localstatedir}/log/%{name}.log -/bin/echo -e "------------------- `/bin/date -R` -------------------\n" \ - >> %{_localstatedir}/log/%{name}.log -%{_bindir}/%{name} --version >> %{_localstatedir}/log/%{name}.log -/bin/echo -e "\n------------------------------ Installed ------------------------------\n" \ - >> %{_localstatedir}/log/%{name}.log -/bin/chown root.root %{_localstatedir}/log/%{name}.log -/bin/chmod 640 %{_localstatedir}/log/%{name}.log - -%postun -if [ "$1" = 0 ]; then - [ ! -d %{_var}/%{name} ] || %{__rm} -rf %{_var}/%{name} - [ ! -d %{_prefix}/lib/%{name} ] || %{__rm} -rf %{_prefix}/lib/%{name} -fi - %files %defattr(-,root,root,-) +%doc %{_docdir}/%{name}-%{version}/* %{_bindir}/%{name} -%dir %{_prefix}/lib/%{name} -%{_prefix}/lib/%{name}/scripts +%dir %{_datadir}/%{name} +%{_datadir}/%{name}/scripts %{_sysconfdir}/cron.daily/01-%{name} -%{_sysconfdir}/logrotate.d/%{name} +%config(noreplace) %{_sysconfdir}/logrotate.d/%{name} %dir %{_var}/%{name} %{_var}/%{name}/db +%{_var}/%{name}/db/i18n %dir %{_var}/%{name}/tmp -%{_sysconfdir}/%{name}.conf -%{_sysconfdir}/sysconfig/%{name} +%config(noreplace) %{_sysconfdir}/%{name}.conf +%config(noreplace) %{_sysconfdir}/sysconfig/%{name} %dir %{_docdir}/%{name}-%{version} -%doc %{_docdir}/%{name}-%{version}/* %{_mandir}/man8/* - %changelog +* Sun Feb 03 2008 Kevin Fenzi - 1.3.0-1 +- Revive package, clean up spec +- Update to 1.3.0 + * Sat Mar 18 2006 Greg Houlette - 1.2.8-3 - Made an RPM transparent change to move the sha1 canary check file out of CVS and into the external lookaside cache (whose