Merge pull request #637 from anonimal/master

Patch rootkit_trojans.txt for s-nail systems.
ossec · Aug 14, 2015 · fac271e · fac271e
2 parents 39334a9 + b2f340c
commit fac271e
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/install.sh b/install.sh
@@ -228,6 +228,10 @@ UseRootcheck()
         echo "    <system_audit>$INSTALLDIR/etc/shared/cis_rhel_linux_rcl.txt</system_audit>" >> $NEWCONFIG
         echo "    <system_audit>$INSTALLDIR/etc/shared/cis_rhel5_linux_rcl.txt</system_audit>" >> $NEWCONFIG
         echo "  </rootcheck>" >> $NEWCONFIG
+	# Patch for systems that use s-nail instead of GNU Mailutils (such as Arch Linux).
+	if strings /usr/bin/mail | grep "x-shsh bash" 1> /dev/null; then
+	  sed -i 's/mail        !bash|/mail        !/' ./src/rootcheck/db/rootkit_trojans.txt
+	fi
     else
       echo "" >> $NEWCONFIG
       echo "  <rootcheck>" >> $NEWCONFIG