rkhunter warns me about root.rules

Question

I run :

:~$ sudo rkhunter --checkall --report-warnings-only

One of the warnings I've got :

Warning: Suspicious file types found in /dev:
         /dev/.udev/rules.d/root.rules: ASCII text

and the root.rules contains :

SUBSYSTEM=="block", ENV{MAJOR}=="8", ENV{MINOR}=="1", SYMLINK+="root"

I would like to understand the meaning and role of those variables SUBSYSTEM, ENV{MAJOR} and SYMLINK+ .

Answer 1

The line in question is a udev rule, which defines certain conditions used to identify the device which the rule is acting upon.

• SUBSYSTEM is a match key, which is matched against the subsystem of the device. In this case, the rule matches only devices from the block sysbsystem.

• ENV is key which may be used for both matching and assigning environment variables. In this case, the rule matches devices with the MAJOR variable previously declared to 8, and the MINOR variable previously declared to 1.

• SYMLINK is an assignment key, which containing a list of symbolic links which act as alternative names for the device node. Actions of the form KEY+="value" add to the actions that are executed, for instance in this case SYMLINK+="root" tells udev to create a symlink called root under the /dev directory, in addition to any other symlinks that are going to be created.

In other words, the above rule tells udev to create and additional symlink /dev/root for devices belonging to the block subsystem with major device number 8 and minor device number 1, i.e. the root partition.

The file in question is created by the mountall file system mounting tool, and unless it's world writable, should not be an issue. rkhunter flags the file because of its type. To suppress the rkhunter warning, you can add a whitelist rule to /etc/rkhunter.conf.local:

ALLOWDEVFILE=/dev/.udev/rules.d/root.rules

Answer 2

The udev rule creates a symbolic link to the blockdevice (SUBSUSTEM=="block") with the information 8,1 (ENV{MAJOR}=="8", ENV{MINOR}=="1" The first partition on the first drive) in your setup. The link is named /dev/root with the SYMLINK+="root", the plus sign tells that udev should not overwrite any previous links created to this device, but rather add one more link to it.

An other rule like this found in some form on many Linux systems is this one:

SUBSYSTEM=="block", ENV{ID_SERIAL}=="DVD_Drive_USB2_10000E0008441C1E", SYMLINK+="cdrom"

This says that the blockdevice with the serialnumber DVD_Drive_USB2_10000E0008441C1E sould be symlinked to /dev/cdrom

I am not entirely sure why rkhunter complains about this, but it is properly due to the type of /dev/.udev/rules.d/root.rules not being a device or symbolic link, but rather a file. I don't think that this is dangerous.