Rkhunter shows 5 possible rootkits

Question

Rkhunter shows 5 rootkits

System checks summary


File properties checks...
Files checked: 149
Suspect files: 0

Rootkit checks...
Rootkits checked : 480
Possible rootkits: 5

Applications checks...
All checks skipped


 Info: Starting test name 'ipc_shared_mem'
 [11:13:02] Info: The minimum shared memory segment size to be checked (in bytes): 1048576 (1,0MB)
 [11:13:02]   Checking for suspicious (large) shared memory segments [ Warning ]
 [11:13:02] Warning: The following suspicious (large) shared memory segments have been found:
 [11:13:02]          Process: /usr/bin/mousepad    PID: 1533    Owner: abigael    Size: 4,0MB (configured size allowed: 1,0MB)
 [11:13:02]          Process: /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1    PID: 1159    Owner: abigael    Size: 4,0MB (configured size allowed: 1,0MB)
 [11:13:02]          Process: /usr/lib/firefox/firefox    PID: 29723    Owner: abigael    Size: 2,4MB (configured size allowed: 1,0MB)
 [11:13:02]          Process: /usr/lib/firefox/firefox    PID: 29723    Owner: abigael    Size: 2,4MB (configured size allowed: 1,0MB)
 [11:13:02]          Process: /usr/bin/xfce4-terminal    PID: 30209         Owner: abigael    Size: 4,0MB (configured size allowed: 1,0MB)

False positive or not?

Answer 1

Info: The minimum shared memory segment size to be checked (in bytes): 1048576 (1,0MB)

and

configured size allowed: 1,0MB

are arbitrary. Who decided that 1Mb is allowed? Seems to me they are guessing here.

Large memory segments can be white listed in /etc/rkhunter.conf so you can suppress this message if you want; what to me also indicates they know about it being a false positive. Why the need to white list it? That is admitting they can not proof there is a rootkit.

Both firefox and xfce4-terminal I would assume to need more than 1Mb. The other 2... no idea if 4Mb is what they need. 4Mb is not a lot so maybe.

I would consider anything rkhunter tells you to be a false positive unless you can stave it with proof from another source. Always use TWO detectors and match their results. If both claim the same issue I'd start to worry.