in reply to Deleting .packlist files

The reason I am asking is because chkrootkit will always ...
Sounds like you need to patch chkrootkit, anyway, perldoc ExtUtils::Installed:
ExtUtils::Installed provides a standard way to find out what core and module files have been installed. It uses the information stored in .packlist files created during installation to provide this information. In addition it provides facilities to classify the installed files and to extract directory information from the .packlist files.

MJD says "you can't just make shit up and expect the computer to know what you mean, retardo!"
I run a Win32 PPM repository for perl 5.6.x and 5.8.x -- I take requests (README).
** The third rule of perl club is a statement of fact: pod is sexy.

Replies are listed 'Best First'.
Re: Re: Deleting .packlist files
by dub4u (Sexton) on Mar 21, 2004 at 21:34 UTC
    Patching chkrootkit is not really an option, because you would open a door for an attacker, who could hide stuff explicitly in .packlist . On the other hand, if you delete your .packlists and one pops up later on a chkrootkit run you would know that either someone has installed or updated a Perl package, or your system may have been compromised. From the chkrootkit FAQ:

    8. chkrootkit is reporting some files and dirs as suspicious: `.packlist', `.cvsignore', etc. These are clearly false positives. Can't you ignore these?

    Ignoring some files and dirs could impair chkrootkit's accuracy. An attacker might use this, since he knows that chkrootkit will ignore certain files and dirs.

    Anyway, if only the mentioned ExtUtils::Installed will cease to function, I think I could live with that. Unless of course, this would have side effects for example in CPAN.pm

    So, let's rephrase my orginal question: can I, or can I not, live without ExtUtils::Installed?

[reply]
      If knowing what .packlist files are for is not enough information I can't help you. How am I supposed to know if you can live without ExtUtils::Installed (I can't)?

      MJD says "you can't just make shit up and expect the computer to know what you mean, retardo!"
      I run a Win32 PPM repository for perl 5.6.x and 5.8.x -- I take requests (README).
      ** The third rule of perl club is a statement of fact: pod is sexy.

[reply]
        Uh, well, right. I have never explicitly used ExtUtils::Installed myself, I use CPAN.pm for managing libraries, but who knows, maybe CPAN relies somewhere on this module.

        I have just tried this: 

            $ perl -d -MCPAN -e shell
    ...
    DB<1> for (keys %INC) {print "$INC{$_}\n" if /ExtUtils/}
    /usr/lib/perl5/5.6.1/ExtUtils/MakeMaker.pm
    /usr/lib/perl5/5.6.1/ExtUtils/MM_Unix.pm
    DB<2>

        [download]
        ...so maybe it would be OK for me. But in the end it's probably a matter of try and see if anything breaks.

        Thanks for your time anyway, PodMaster!

[reply]
[d/l]

In Section Seekers of Perl Wisdom