Should tripwire be entering /proc?
Posted
by
dsadinoff
on Server Fault
See other posts from Server Fault
or by dsadinoff
Published on 2012-03-19T09:31:19Z
Indexed on
2012/03/19
10:07 UTC
Read the original article
Hit count: 290
linux
When initializing the db with tripwire --init it spat out a bunch of errors pertaining to /proc:
### Warning: File system error.
### Filename: /proc/16982/fd/4
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /proc/16982/fdinfo/4
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /proc/16982/task/16982/fd/4
### No such file or directory
### Continuing...
### Warning: File system error.
### Filename: /proc/16982/task/16982/fdinfo/4
### No such file or directory
### Continuing...
### Warning: Duplicate object encountered.
### /proc/sys/net/ipv6/neigh
This feels like noise. The twpol.txt
file has the following clause:
#
# Critical devices
#
(
rulename = "Devices & Kernel information",
severity = $(SIG_HI),
)
{
/dev -> $(Device) ;
/proc -> $(Device) ;
}
Which, if I understand it right, is going to cause tripwire to care deeply about the entire contents of /proc. Shouldn't it just care about the static parts of /proc like the drivers and such, and not the per-pid stuff? Why does it ship like this?
© Server Fault or respective owner