Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm getting a warning from this executable along with /usr/bin/mail. Apparently, the latter is a symbolic link to /etc/alternatives/mail which in turn is a symbolic link to the former. Is it part of the official Ubuntu package?

And what of these, anybody familiar?

[11:22:59]   Checking /dev for suspicious file types         [ Warning ]
[11:22:59] Warning: Suspicious file types found in /dev:
[11:22:59]          /dev/shm/pulse-shm-3395357841: data
[11:22:59]          /dev/shm/pulse-shm-209100905: data
[11:22:59]          /dev/shm/pulse-shm-1946326073: data
[11:22:59]          /dev/shm/pulse-shm-398300649: data
[11:22:59]          /dev/shm/pulse-shm-1247248499: data
[11:22:59]          /dev/shm/pulse-shm-919341478: data
[11:22:59]          /dev/shm/pulse-shm-3492730495: data
[11:22:59]          /dev/shm/pulse-shm-2387631939: data
[11:22:59]          /dev/shm/mono.1905: data
[11:22:59]          /dev/shm/pulse-shm-2124227282: data
[11:22:59]          /dev/shm/pulse-shm-626708369: data
[11:22:59]          /dev/shm/pulse-shm-135679340: data
[11:22:59]          /dev/shm/pulse-shm-2263796104: data
[11:22:59]          /dev/shm/pulse-shm-2124025764: data
[11:22:59]          /dev/shm/pulse-shm-226259018: data
[11:22:59]          /dev/shm/pulse-shm-1077030235: data
[11:23:00]   Checking for hidden files and directories       [ Warning ]
[11:23:00] Warning: Hidden directory found: /etc/.java
[11:23:00] Warning: Hidden directory found: /dev/.udev
[11:23:00] Warning: Hidden directory found: /dev/.initramfs
share|improve this question
I got this after a search: But why is it being flagged as suspicious? It is just a warning but I'm a bit on the paranoid side. I've checked my Meerkat installation (I am running on Natty now) there are no executables - bsd-mailx or mail - found under /usr/bin. – Marky May 27 '11 at 3:50
Did you use rkhunter? If so this program is famous for it's false positives. Did you do an update after installing? If not it will get better results. If so delete it and use Clamav. It is a lot better. – Rinzwind May 27 '11 at 3:56
Yes I used rkhunter. There is another rootkit available in the official repos. I'll use that and see what it says. I'm just wary of things installed on my system and are being flagged as suspicious and previous Ubuntu version doesn't have it. I was having an internet connection issue earlier where my ISPs DHCP server was giving me the wrong private address, but I was getting activity on my network monitor. If I don't have an internet connection, I should be getting zero bytes coming in. Fortunately, there were no outgoing connections. – Marky May 27 '11 at 4:10
rkhunter has a habit of showing false positives. use clamav; it has a better check on rootkits. – Rinzwind May 27 '11 at 5:29

The symlinks are a normal part of the "alternatives" system used by the packaging system. In some cases, the same commands are provided by multiple packages. To handle this, each package installs their version of the command with a unique name and the common command name is symlinked to one of the versions. The symlinks can be updated using the update-alternatives utility.

Now rather than directly symlinking from /usr/bin/mail to /usr/bin/bsd-mailx, the connection is made through a second symlink in /etc/alternatives. This allows different systems that share a common /usr but separate /etc to pick different alternatives.

share|improve this answer

You can answer this question yourself by checking with dpkg:

dpkg -S /usr/bin/bsd-mailx
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.