uname -p -i reports unknown

LocoMojo · 12-19-2005, 09:20 AM

When I run Rkhunter (RootKitHunter) to detect any rootkits I may have on my system Rkhunter reports:

Quote:

Determining OS... Unknown
Warning: This operating system is not fully supported!
Warning: Cannot find md5_not_known
All MD5 checks will be skipped!

This is probably because uname -p and uname -i both report 'unknown'.

This is odd because KDE's KInfoCenter reports my processor information correctly.

What can I do to fix uname's problem?

Thanks in advance.

LocoMojo

vls · 12-19-2005, 09:54 AM

uname is broken in slackware and the stock coreutils source.

Here's thread with a patch.

LocoMojo · 12-19-2005, 10:13 AM

Thanks for that!

Downloading the packages now. Will report success/fail when I'm done.

Wonder why Pat doesn't fix this?

Thanks again!

LocoMojo

LocoMojo · 12-19-2005, 10:44 AM

Worked like a charm!

Many thanks to you for telling me about this and many thanks to Carlos for making this patch available to us.

Unfortunately, it didn't solve my problem with rkhunter as it is still reporting unknown OS.

I wonder if this patch has solved anything functionally for me or is it was just a cosmetic thing?

Thanks again.

LocoMojo

vls · 12-19-2005, 11:17 AM

Quote:

Originally Posted by LocoMojo

Worked like a charm!
...
I wonder if this patch has solved anything functionally for me or is it was just a cosmetic thing?

Thanks again.

LocoMojo

No problem.

It's really just cosmetic but you never know; something may depend on it to work properly.

Is this rkhunter: http://www.rootkit.nl/
If so, unfortunately I can't test it because my main linux box gave up the ghost and all I have is an old laptop that has no room for perl. But I can grep through the code and maybe figure out where it's trying to pull the info from.

LocoMojo · 12-19-2005, 11:27 AM

Quote:

Originally Posted by vls

No problem.

It's really just cosmetic but you never know; something may depend on it to work properly.

Is this rkhunter: http://www.rootkit.nl/
If so, unfortunately I can't test it because my main linux box gave up the ghost and all I have is an old laptop that has no room for perl. But I can grep through the code and maybe figure out where it's trying to pull the info from.

Ahh well, at least it'll look good when I show my Windows friends my Linux box. Unknown doesn't look very good and they'll just say, "see, Linux doesn't even know what it's running on".

Yep, that's the rkhunter I'm talking about.

I just found out that Slackware 10.2 isn't supported, but Slackware 10.1 is.

Shrug...go figure.

Thanks again and have a good one.

LocoMojo

vls · 12-19-2005, 11:31 AM

I looked it over and it does use uname; make sure your new version is getting called instead of the broke uname

Have a better one.

LocoMojo · 12-19-2005, 11:46 AM

Quote:

Originally Posted by vls

I looked it over and it does use uname; make sure your new version is getting called instead of the broke uname

Have a better one.

Well, I used upgradepkg when I installed the patched coreutils so I'm assuming the broken uname is gone...right?

LocoMojo

vls · 12-19-2005, 11:57 AM

Quote:

Originally Posted by LocoMojo

Well, I used upgradepkg when I installed the patched coreutils so I'm assuming the broken uname is gone...right?

LocoMojo

Yeah, it should. Damn, I need a new computer so I can test things properly.

LocoMojo · 12-20-2005, 01:15 PM

Warning!

This patched coreutils package breaks swaret.

Quote:

root@slack:~# swaret --update
swaret 1.6.3-2

head: `-1' option is obsolete; use `-n 1'
Try `head --help' for more information.
Network Connection down!
Please, take a look to 'NIC' in /etc/swaret.conf!

My NIC is fine as I'm able to browse the network with Firefox, email with Thunderbird, use FTP with ncftp, ping servers, etc.

I've touched nothing with the NIC part of my swaret.conf so I'm assuming it has something to do with the head problem.

Quote:

root@slack:/usr/sbin# less swaret | grep head
ip_address=`ifconfig | grep "inet addr" | grep -v 127.0.0.1 | tee | awk '{ print $2 }' | awk -F":" '{ print $2 }' | head -1`
rDATE=`head -1 $CDIR/rollback/ROLLBACK.TXT | awk {'print $3 " " $4'}`
OUTPUT=`cat /proc/$z/status | head -1`
TOPPER=`head -n 1 BUILDLIST.tmp`
PLACE=`grep -n ^$VAR /etc/swaret.conf | head -1 | awk -F : {'print $1'}`
PLACE=`grep -n ^[#]$VAR /etc/swaret.conf | head -1 | awk -F : {'print $1'}`
head -`echo $PLACE - 1 | bc` /etc/swaret.conf 2>/dev/null > /etc/swaret.conf.tmp 2>/dev/null
rDATE=`tail -n $1 ROLLBACK.TXT | head -n 1 | awk {'print $1'}`
rTIME=`tail -n $1 ROLLBACK.TXT | head -n 1 | awk {'print $2'} | sed s/':'//\g`

Obviously something has changed in the patched coreutils package to make head -1 obsolete. I went ahead and backed up my swaret then edited ip_address part like this:

Quote:

ip_address=`ifconfig | grep "inet addr" | grep -v 127.0.0.1 | tee | awk '{ print $2 }' | awk -F":" '{ print $2 }' | head -1`

to

ip_address=`ifconfig | grep "inet addr" | grep -v 127.0.0.1 | tee | awk '{ print $2 }' | awk -F":" '{ print $2 }' | head -n 1`

Then swaret worked fine again.

Obviously the patched coreutils package is making some fundamental changes to coreutils rather than just adding a little piece of code to enable uname to report -p -i information. Head -1 was made obsolete, who knows what else has been made obsolete or broken.

The uname deal, as far as I know, is simply cosmetic and has no impact on how things work so it isn't worth it to patch coreutils as it may break a number of things throughout the system.

Originally I wanted to fix the uname problem of reporting -p -i as unknown to get rkhunter working correctly on my system. Fixing uname with the patched coreutils didn't help rkhunter at all.

I'm downgrading back to Pat's coreutils release...screw uname -p -i.

LocoMojo

Edit: Something just dawned on me. I wonder if I'm having this problem because I compiled the patched coreutils package with the new gcc package. Maybe it's gcc-3.4.5 that made head -1 obsolete...kinda makes sense, doesn't it?

Edit2: Just downgraded to the old gcc version (3.3.6) and then compiled and installed the patched coreutils package. Still no go, same problem as above so now I know for sure that it is the patch that is the culprit somehow.

Alien Bob · 12-20-2005, 02:52 PM

Actually, the problem with these error messages is the fact that a newer glibc version is now present on current Slackware systems. The Slackware coreutils were built with glibc 2.3.2 (for Slackware 10.0) and never re-compiled for newer Slackware releases.

I have a patched Slackware 10.2 package for coreutils uploaded here.
It has a patched uname, my output looks like this:

Quote:

$ uname -a
Linux icculus 2.6.13 #1 Sat Sep 3 21:11:20 PDT 2005 i686 athlon-4 i386 GNU/Linux

and it has properly working versions of head tail etc...

Eric

LocoMojo · 12-20-2005, 04:07 PM

Quote:

Originally Posted by Alien Bob

Actually, the problem with these error messages is the fact that a newer glibc version is now present on current Slackware systems. The Slackware coreutils were built with glibc 2.3.2 (for Slackware 10.0) and never re-compiled for newer Slackware releases.

I have a patched Slackware 10.2 package for coreutils uploaded here.
It has a patched uname, my output looks like this:

and it has properly working versions of head tail etc...

Eric

That did the trick, thanks! Is it safe to assume that this patched coreutils package won't have any effect on anything else?

Can you tell me though, what's the difference between uname -m and uname -i (machine hardware name vs. hardware platform)?

My uname is reporting:

Quote:

Linux slack 2.6.14.4 #1 Sun Dec 18 17:58:58 EST 2005 i686 pentium4 i386 GNU/Linux

When I compile stuff without any compiler flags, is it, by default, optimized for i386 or i686?

Thanks again!

LocoMojo

servnov · 12-20-2005, 05:16 PM

Just tried using uname on slack and got that unknown stuff too. Hopefully it will be fixed in next release.

sweetnsourbkr · 12-20-2005, 06:44 PM

The fix is actually quite easy, only takes about 15 mins, if that.

Woodsman · 12-20-2005, 08:32 PM

Quote:

I have a patched Slackware 10.2 package for coreutils uploaded here.

Eric, I downloaded the patch and the unknowns went bye-bye. Ya done good---thank you!

Will we have to download this patch with the next Slack release or will the coreutils programs be compiled in that release against the correct version of glibc?

If the next release will be compiled properly, will upgradepkg still work against your patched version or will we have to remember to uninstall your patched version before updating Slack to the next release?