From: "francois@debian.org" <francois@debian.org>
Date: Sun, 9 Jul 2017 18:42:55 +0200
Subject: README

Update README to mention -e and attitude to false positives

Forwarded: yes
(Forwarded by email: 21 Dec 2024)
---
 README | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/README b/README
index dae803a..371ccf1 100644
--- a/README
+++ b/README
@@ -123,6 +123,8 @@
          -d                debug
          -q                quiet mode
          -x                expert mode
+         -e                exclude known false positive files/dirs, quoted,
+                           space separated, READ WARNING IN README
          -r dir            use dir as the root directory
          -p dir1:dir2:dirN path for the external commands used by chkrootkit
          -n                skip NFS mounted dirs
@@ -181,6 +183,31 @@
 
    # ./chkrootkit -r /mnt
 
+ Sometimes the test for dot files in system directories will report
+ false positives for legitimate files. It has been argued that while
+ chkrootkit could be made to ignore these false positives, that might
+ result in attackers deliberately using those names in order to avoid
+ detection. For that reason chkrootkit does not exclude any false
+ positives by default. However, many people use chkrootkit as a
+ daily cron job, and having these false positives means that the
+ administrator gets daily emails reporting these files. This probably
+ would result in the administrator:
+   A) not checking those files each time they were reported, which
+      means than an attacker could still use those names to avoid
+      detection
+   B) getting into the habit of deleting the reports without looking
+      closely at them, which means they are more likely to miss a real
+      problem
+ Because the above would result in less security, there is support for
+ excluding files, using the -e flag, for example:
+
+   # ./chkrootkit -e '/run/.ramfs'
+
+ WARNING: by using this option you are giving attackers a way to avoid
+ detection! Make absolutely sure that these are truly false positives
+ and do a periodic check of any excluded files to make sure they are
+ still the legitimate files you think they are.
+
 
  7. Output Messages
  ------------------
