5

I'm getting a warning from this executable along with /usr/bin/mail. Apparently, the latter is a symbolic link to /etc/alternatives/mail which in turn is a symbolic link to the former. Is it part of the official Ubuntu package?

And what of these, anybody familiar?

[11:22:59]   Checking /dev for suspicious file types         [ Warning ]
[11:22:59] Warning: Suspicious file types found in /dev:
[11:22:59]          /dev/shm/pulse-shm-3395357841: data
[11:22:59]          /dev/shm/pulse-shm-209100905: data
[11:22:59]          /dev/shm/pulse-shm-1946326073: data
[11:22:59]          /dev/shm/pulse-shm-398300649: data
[11:22:59]          /dev/shm/pulse-shm-1247248499: data
[11:22:59]          /dev/shm/pulse-shm-919341478: data
[11:22:59]          /dev/shm/pulse-shm-3492730495: data
[11:22:59]          /dev/shm/pulse-shm-2387631939: data
[11:22:59]          /dev/shm/mono.1905: data
[11:22:59]          /dev/shm/pulse-shm-2124227282: data
[11:22:59]          /dev/shm/pulse-shm-626708369: data
[11:22:59]          /dev/shm/pulse-shm-135679340: data
[11:22:59]          /dev/shm/pulse-shm-2263796104: data
[11:22:59]          /dev/shm/pulse-shm-2124025764: data
[11:22:59]          /dev/shm/pulse-shm-226259018: data
[11:22:59]          /dev/shm/pulse-shm-1077030235: data
[11:23:00]   Checking for hidden files and directories       [ Warning ]
[11:23:00] Warning: Hidden directory found: /etc/.java
[11:23:00] Warning: Hidden directory found: /dev/.udev
[11:23:00] Warning: Hidden directory found: /dev/.initramfs
3
  • I got this after a search: launchpad.net/ubuntu/+source/bsd-mailx. But why is it being flagged as suspicious? It is just a warning but I'm a bit on the paranoid side. I've checked my Meerkat installation (I am running on Natty now) there are no executables - bsd-mailx or mail - found under /usr/bin.
    – Marky
    May 27, 2011 at 3:50
  • 1
    Did you use rkhunter? If so this program is famous for it's false positives. Did you do an update after installing? If not it will get better results. If so delete it and use Clamav. It is a lot better.
    – Rinzwind
    May 27, 2011 at 3:56
  • Yes I used rkhunter. There is another rootkit available in the official repos. I'll use that and see what it says. I'm just wary of things installed on my system and are being flagged as suspicious and previous Ubuntu version doesn't have it. I was having an internet connection issue earlier where my ISPs DHCP server was giving me the wrong private address, but I was getting activity on my network monitor. If I don't have an internet connection, I should be getting zero bytes coming in. Fortunately, there were no outgoing connections.
    – Marky
    May 27, 2011 at 4:10

2 Answers 2

3

The symlinks are a normal part of the "alternatives" system used by the packaging system. In some cases, the same commands are provided by multiple packages. To handle this, each package installs their version of the command with a unique name and the common command name is symlinked to one of the versions. The symlinks can be updated using the update-alternatives utility.

Now rather than directly symlinking from /usr/bin/mail to /usr/bin/bsd-mailx, the connection is made through a second symlink in /etc/alternatives. This allows different systems that share a common /usr but separate /etc to pick different alternatives.

3

You can answer this question yourself by checking with dpkg:

dpkg -S /usr/bin/bsd-mailx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .