On my debian squeeze server in the chkrootkit log I get loads of these errors:

/usr/bin/find: Prozeß "head" wurde durch das Signal 13 abgebrochen.
/usr/bin/find: Prozeß "head" wurde durch das Signal 13 abgebrochen.

which means

head terminated by signal 13

A google search gives a lot of same problems, but no solution.

It comes from these lines in /usr/sbin/chkrootkit:

if [ `echo abc | head -n 1` = "abc" ]; then
      fileshead="`${find} ${ROOTDIR}tmp ${ROOTDIR}var/tmp ${findargs} -type f -exec head -n 1 {} \; | $egrep '#!.*php' 2> /dev/null`"
      fileshead="`${find} ${ROOTDIR}tmp ${ROOTDIR}var/tmp ${findargs} -type f -exec head -1 {} \; | grep '#!.*php' 2> /dev/null`"

when I enter directly as root:

/usr/bin/find /var/tmp -type f -exec head -1 {} \; | grep php 2> /dev/null;date

I get the same errors. egrep instead makes no difference.

  • I solved that problem temporarily by commenting out these lines in the chkrootkit script, but that is not a solution :( – rubo77 Aug 19 '13 at 1:38

chkrootkit searches for PHP files in /tmp/ and /var/tmp directories. Most likely, some files there trigger the bug. In my case, it was a test file with lots of zero bytes - deleting the file solved the issue.

| improve this answer | |
  • I created a testfile with lots of nullbytes with dd if=/dev/zero of=/var/tmp/nullbytes count=1 bs=1M but the command /usr/bin/find /var/tmp -type f -exec head -1 {} \; | grep php 2> /dev/null;date did not throw any errors. could it be, that the error is fixed since wheezy? – rubo77 Nov 26 '13 at 10:56
  • I had a similar file of 1GB length. Ubuntu Precise; maybe newer versions do not have this bug. – VladV Nov 26 '13 at 12:14
  • That's it! I created an 1GB file with only zero bytes and then I got the error again. so deleting that temp file is the solution. A pity, that I don't know, how such a file could have been created there in the first place – rubo77 Nov 26 '13 at 13:24
  • I reported this to this debian bugreport: bugs.debian.org/cgi-bin/bugreport.cgi?bug=588121 – rubo77 Nov 26 '13 at 13:33

Here is a simple implementation of the ideas behind Alex's answer below. I commented out the code at about line 1241 of the main chkrootkit shell script, and added replacement code following it:

###if [ `echo abc | head -n 1` = "abc" ]; then
###      fileshead="`${find} ${ROOTDIR}tmp ${ROOTDIR}var/tmp ${findargs} -type f -exec head -n 1 {} \; | $egrep '#!.*php' 2> /dev/null`" 
###      fileshead="`${find} ${ROOTDIR}tmp ${ROOTDIR}var/tmp ${findargs} -type f -exec head -1 {} \; | grep '#!.*php' 2> /dev/null`"

SUFF=`date "+%m%d%H%M%S.%N"`
echo > /tmp/matches.$SUFF

for F in `${find} ${ROOTDIR}tmp ${ROOTDIR}var/tmp ${findargs} -type f -print`
    read line <$F
    match=`echo "$line" | grep '#!.*php' 2> /dev/null`
    if [ -n "$match" ]
        echo "$F : $match" >> /tmp/matches.$SUFF

fileshead=`cat /tmp/matches.$SUFF`
rm -f /tmp/matches.$SUFF

This works, and allows chkrootkit to complete.

| improve this answer | |

The problem is that head at exit close the stdout, the first head output work correctly but any other write to the stdout fail with SIGPIPE.

You may want to use a different approach

head -q -n1 $(find /somedir/ -type f)|grep someword


save a script like the one below somewhere, name it as you like, make it executable and replace head in the chkrootkit.

test -f "$1" || exit 1
read line <$1 
echo "$line"

It isn't full head compatible, so use it only on the part of chkrootkit that you've posted here.

| improve this answer | |
  • so how would I repair the command in my question accordingly? It is the original chkrootkit-script – rubo77 Aug 19 '13 at 1:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.