X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;f=src%2Frootcheck%2Fcheck_rc_trojans.c;h=1ee24efa8cbc929f0e9d9e1d96193fb6bc28bf02;hb=6ef2f786c6c8ead94841b5f93baf9f43421f08c8;hp=e30cd8071cf1b3c5021c15de1e21d47be4756edb;hpb=914feba5d54f979cd5d7e69c349c3d01f630042a;p=ossec-hids.git diff --git a/src/rootcheck/check_rc_trojans.c b/src/rootcheck/check_rc_trojans.c index e30cd80..1ee24ef 100755 --- a/src/rootcheck/check_rc_trojans.c +++ b/src/rootcheck/check_rc_trojans.c @@ -1,15 +1,16 @@ -/* @(#) $Id: check_rc_trojans.c,v 1.12 2009/06/24 18:53:07 dcid Exp $ */ +/* @(#) $Id: ./src/rootcheck/check_rc_trojans.c, 2011/09/08 dcid Exp $ + */ /* Copyright (C) 2009 Trend Micro Inc. * All right reserved. * * This program is a free software; you can redistribute it * and/or modify it under the terms of the GNU General Public - * License (version 3) as published by the FSF - Free Software + * License (version 2) as published by the FSF - Free Software * Foundation */ - + #include "shared.h" #include "rootcheck.h" @@ -53,7 +54,7 @@ void check_rc_trojans(char *basedir, FILE *fp) /* Normalizing line */ nbuf = normalize_string(buf); - + if(*nbuf == '\0' || *nbuf == '#') { @@ -69,7 +70,7 @@ void check_rc_trojans(char *basedir, FILE *fp) { continue; } - + *string_to_look = '\0'; string_to_look++; @@ -80,26 +81,26 @@ void check_rc_trojans(char *basedir, FILE *fp) } *message = '\0'; message++; - + string_to_look = normalize_string(string_to_look); file = normalize_string(file); message = normalize_string(message); - - + + if(*file == '\0' || *string_to_look == '\0') { continue; } - + _total++; - - + + /* Trying with all possible paths */ while(all_paths[i] != NULL) { if(*file != '/') { - snprintf(file_path, OS_SIZE_1024, "%s/%s/%s",basedir, + snprintf(file_path, OS_SIZE_1024, "%s/%s/%s",basedir, all_paths[i], file); } @@ -108,15 +109,15 @@ void check_rc_trojans(char *basedir, FILE *fp) strncpy(file_path, file, OS_SIZE_1024); file_path[OS_SIZE_1024 -1] = '\0'; } - + /* Checking if entry is found */ if(is_file(file_path) && os_string(file_path, string_to_look)) { char op_msg[OS_SIZE_1024 +1]; _errors = 1; - + snprintf(op_msg, OS_SIZE_1024, "Trojaned version of file " - "'%s' detected. Signature used: '%s' (%s).", + "'%s' detected. Signature used: '%s' (%s).", file_path, string_to_look, *message == '\0'? @@ -131,7 +132,7 @@ void check_rc_trojans(char *basedir, FILE *fp) } i++; } - continue; + continue; }