2

rkhunter complains about this:

Warning: Suspicious file types found in /dev:
         /dev/.udev/queue.bin: data
         /dev/.udev/data/c13:66: ASCII text
         /dev/.udev/data/c13:64: ASCII text
         /dev/.udev/data/c13:65: ASCII text
         /dev/.udev/data/c13:67: ASCII text
         /dev/.udev/data/+input:input2: ASCII text
         /dev/.udev/data/+input:input1: ASCII text
         /dev/.udev/data/+input:input3: ASCII text
         /dev/.udev/data/+input:input0: ASCII text
         /dev/.udev/data/b9:1: ASCII text
         /dev/.udev/data/b9:2: ASCII text
         /dev/.udev/data/b9:0: ASCII text
         /dev/.udev/data/c116:2: ASCII text
         /dev/.udev/data/b7:7: ASCII text
         /dev/.udev/data/b7:6: ASCII text
         /dev/.udev/data/b7:5: ASCII text
         /dev/.udev/data/b7:4: ASCII text
         /dev/.udev/data/b7:3: ASCII text
         /dev/.udev/data/b7:2: ASCII text
         /dev/.udev/data/b7:1: ASCII text
         /dev/.udev/data/b7:0: ASCII text
         /dev/.udev/data/+serio:serio0: ASCII text
         /dev/.udev/data/c189:0: ASCII text
         /dev/.udev/data/c189:512: ASCII text
         /dev/.udev/data/c189:384: ASCII text
         /dev/.udev/data/c189:256: ASCII text
         /dev/.udev/data/c189:128: ASCII text
         /dev/.udev/data/b8:19: ASCII text
         /dev/.udev/data/b8:18: ASCII text
         /dev/.udev/data/b8:17: ASCII text
         /dev/.udev/data/b8:16: ASCII text
         /dev/.udev/data/b8:3: ASCII text
         /dev/.udev/data/b8:2: ASCII text
         /dev/.udev/data/b8:1: ASCII text
         /dev/.udev/data/b8:0: ASCII text
         /dev/.udev/data/n2: ASCII text
         /dev/.udev/data/c226:0: ASCII text
         /dev/.udev/rules.d/61-dev-root-link.rules: ASCII text
         /dev/.mdadm/map: ASCII text

why is this happening since the upgrade to debian wheezy?

And why would it be bad, that they are ascii?

rubo77
  • 2,282
  • 3
  • 32
  • 63

1 Answers1

3

This is a false positive. Check this page.

A result of that change is, that udev no longer uses /dev/ to store its runtime state file, i.e. the /dev/.udev/ directory, /dev/.udevdb and /dev/.udev.tdb are gone and udev uses /run/udev/ now.

Petter H
  • 3,383
  • 1
  • 14
  • 18