/dev/.udev? Googled, nothing. Searched here, nothing.

svarmido · 10-15-2006, 03:09 PM

Running "rkhunter" brought my attention to this file -
/dev/.udev
/..
/db
/failed

Contents of /db;
block@hda
block@hda@hda1
block@hda@hda10

etc...

Doesn't matter at this point what is in /failed..

Deleting the file /dev/.udev prevents certain programs from running, including "system-config-services"...

Is this a "fake" file setup used by an intruder bypassing /var/run/udev?

svarmido

kevkim55 · 10-15-2006, 04:19 PM

If you are trying to know more about /dev/.udev, guess you should probably look into the udev source code ! Cheers !!

unSpawn · 10-15-2006, 07:02 PM

Is this a "fake" file setup used by an intruder bypassing /var/run/udev?
Most likely not, "man udev" for info and if you "grep udev rkhunter.conf" you'll see it's a common dir that can be excluded from scan.

svarmido · 10-16-2006, 03:08 PM

Most likely not? A pretty equivocal response. There is no reference to /dev/.udev anywhere in the man file, only /dev and /etc/udev/. Looking into the source code is not something I have the skill or knowledge to do.

Is /dev/.udev present in others Fedora Core 5 installs?

svarmido

unSpawn · 10-16-2006, 04:30 PM

Udev-102.tar.gz, RELEASE-NOTES, line 315:
The option "udev_db" does no longer exist. All udev state will be in /$udev_root/.udev/ now, there is no longer an option to set this to anything else. If the init script or something else used this value, just depend on this hardcoded path. But remember _all_content_ of this directory is still private to udev and can change at any time.
So this is the dir where Udev tools keep state.

osor · 10-16-2006, 05:00 PM

Quote:

Originally Posted by svarmido

Most likely not? A pretty equivocal response. There is no reference to /dev/.udev anywhere in the man file, only /dev and /etc/udev/. Looking into the source code is not something I have the skill or knowledge to do.

Is /dev/.udev present in others Fedora Core 5 installs?

svarmido

In older versions of udev, you could set the location of the udev database inside udev.conf (you could set the variable udev_db just like udev_root or udev_rules). If you read the RELEASE-NOTES (specifically lines 315-316), it says there is no longer an option to alter this variable (it will always be set to “/$udev_root/.udev/”) (ever since version 076).