Skip to content

Maldetect not working, because grep from stdin detects binary file #446

@pschonmann

Description

@pschonmann

The affected command is

/usr/bin/cpulimit -l 200 -- /usr/bin/nice -n 19 /usr/bin/ionice -c2 -n 6 /usr/bin/find /lmd_find/ /var/www /tmp -path '"/usr/local/maldetect"' -prune -o -maxdepth 15 -regextype posix-egrep -type f -size +24c -size -6947618c -not -perm 000 -not -iname '"*.css"' -not -iname '"*.csv"' -not -iname '"*.gif"' -not -iname '"*.gz"' -not -iname '"*.html"' -not -iname '"*.jpeg"' -not -iname '"*.jpg"' -not -iname '"*.js"' -not -iname '"*.log"' -not -iname '"*.mp3"' -not -iname '"*.mp4"' -not -iname '"*.pdf"' -not -iname '"*.png"' -not -iname '"*.so"' -not -iname '"*.tar"' -not -iname '"*.tmp"' -not -iname '"*.txt"' -not -iname '"*.wav"' -not -iname '"*.webp"' -not -iname '"*.zip"' -not -iname '"*.zst"' -not -iname '"*sess_.*"' | grep -E -vf /usr/local/maldetect/ignore_paths

that gives me

/var/www/grocy.schonmann.eu/public_html/migrations/0118.sql
/var/www/grocy.schonmann.eu/public_html/migrations/0037.sql
/var/www/grocy.schonmann.eu/public_html/migrations/0098.sql
/var/www/grocy.schonmann.eu/public_html/README.md
/var/www/grocy.schonmann.eu/public_html/config-dist.php
/var/www/grocy.schonmann.eu/config.php
/tmp/zcom-keys.deb
/tmp/rc_local.tmp
/tmp/file_stat_443.tmp
/tmp/file_stat_80.tmp
Process 360392 dead!
Process 360392 detected
grep: (standard input): binary file matches

When i add -a to grep its working

file of ignored path contains

cat /usr/local/maldetect/ignore_paths
/usr/local/maldetect
/usr/local/sbin/maldet
/var/www/.*/tmp

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions