Debian Bug report logs - #627415
aide: AIDE aborts on $ I think

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Tim Phipps <tim@phipps-hutton.freeserve.co.uk>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: aide: AIDE aborts on $ I think

Date: Fri, 20 May 2011 13:18:27 +0100

Package: aide
Version: 0.15.1-3
Severity: normal

Got this email this morning after I had installed Horde from PEAR. /tmp is a symlink to /dev/shm/tmp so the directory in question is /tmp/buildd.

******************************************************************************
*IDE returned with exit code 137. AIDE returned an unknown non-zero exit valu*
*                             exit value is 137                              *
******************************************************************************
AIDE post run information
output database /var/lib/aide/aide.db.new was copied to /var/lib/aide/aide.db as requested by cron job configuration
End of AIDE post run information

Errors produced  (2 lines):
Error in selective regexp: /dev/shm/tmp/buildd/php5-5\.3\.3/pear-build-download/Horde_ActiveSync-1\.0\.0/test/Horde/ActiveSync/{137c3bb0-838d-499a-9f0e-fb6c0761da51}1$
Killed

End of AIDE error output.

funny, AIDE did not leave a log.
=======
I have !/dev in my local aide config so it shouldn't even go down that path. Also it should not be doing anything with the file names and it looks like it's doing variable expansion or something.


-- System Information:
Debian Release: 6.0.1
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 2.6.32-5-686-bigmem (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages aide depends on:
ii  aide-common        0.15.1-3              Advanced Intrusion Detection Envir
ii  bsd-mailx          8.1.2-0.20100314cvs-1 simple mail user agent
ii  liblockfile1       1.08-4                NFS-safe locking library, includes
ii  ucf                3.0025+nmu1           Update Configuration File: preserv

Versions of packages aide recommends:
ii  cron                          3.0pl1-116 process scheduling daemon

aide suggests no packages.

-- no debconf information

Message #10 received at 627415@bugs.debian.org (full text, mbox, reply):

From: Hannes von Haugwitz <hannes@vonhaugwitz.com>

To: Tim Phipps <tim@phipps-hutton.freeserve.co.uk>, 627415@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: [Pkg-aide-maintainers] Bug#627415: aide: AIDE aborts on $ I think

Date: Fri, 20 May 2011 15:27:43 +0200

tags 627415 moreinfo

Hi,

could you please provide the part of
/var/lib/aide/aide.conf.autogenerated from which the wrong rule comes from
and the output of 'ls /dev/shm/tmp/buildd/php5-<rest-of-filename>'?

Greetings

Hannes

Message #17 received at 627415@bugs.debian.org (full text, mbox, reply):

From: Tim Phipps <tim@phipps-hutton.freeserve.co.uk>

To: Hannes von Haugwitz <hannes@vonhaugwitz.com>

Cc: <627415@bugs.debian.org>, <control@bugs.debian.org>

Subject: Re: [Pkg-aide-maintainers] Bug#627415: aide: AIDE aborts on $ I think

Date: Fri, 20 May 2011 21:03:05 +0100

[Message part 1 (text/plain, inline)]

On Fri, 20 May 2011 15:27:43 +0200, Hannes von Haugwitz
<hannes@vonhaugwitz.com> wrote:
> tags 627415 moreinfo
> 
> Hi,
> 
> could you please provide the part of
> /var/lib/aide/aide.conf.autogenerated from which the wrong rule comes
from
> and the output of 'ls /dev/shm/tmp/buildd/php5-<rest-of-filename>'?
> 
> Greetings
> 
> Hannes

Afraid I cannot. I deleted that directory and I don't want to have to
reinstall horde all over again. Attached is aide.conf.autogen. My rule for
!/dev is down near the bottom but above that it looks like one of the other
conf.d files is walking the entire /dev tree making rules for each file. I
run a bit of a non-standard systemin that I move /tmp, /lib/init,
/var/lock, /var/run and /var/tmp all under /dev so maybe I just need to
nuke the conf.d part.

[aide.conf.autogenerated (text/plain, attachment)]

Message #22 received at 627415-done@bugs.debian.org (full text, mbox, reply):

From: Hannes von Haugwitz <hannes@vonhaugwitz.com>

To: Tim Phipps <tim@phipps-hutton.freeserve.co.uk>, 627415-done@bugs.debian.org

Cc: Thijs Kinkhorst <thijs@debian.org>

Subject: Re: Bug#627415: aide: AIDE aborts on $ I think

Date: Fri, 31 May 2013 07:17:14 +0200

Version: 0.15.1-4

Hello,

On Fri, May 20, 2011 at 01:18:27PM +0100, Tim Phipps wrote:
> Got this email this morning after I had installed Horde from PEAR.
> /tmp is a symlink to /dev/shm/tmp so the directory in question is
> /tmp/buildd.
> 
> ******************************************************************************
> *IDE returned with exit code 137. AIDE returned an unknown non-zero exit valu*
> *                             exit value is 137                              *
> ******************************************************************************
> AIDE post run information
> output database /var/lib/aide/aide.db.new was copied to /var/lib/aide/aide.db as requested by cron job configuration
> End of AIDE post run information
> 
> Errors produced  (2 lines):
> Error in selective regexp: /dev/shm/tmp/buildd/php5-5\.3\.3/pear-build-download/Horde_ActiveSync-1\.0\.0/test/Horde/ActiveSync/{137c3bb0-838d-499a-9f0e-fb6c0761da51}1$

This error was caused by the 70_aide_dev script, which generated an
individual rule for each file in /dev but didn't escape the '{' and '}'
characters. This script was replaced by a single native aide rule in
0.15.1-4. Hence I close this bug now.

Best regards

Hannes

Send a report that this bug log contains spam.