rkhunter and portage: a hook to avoid false positives

[hujuice]

rkhunter is a precious tool to keep a system under watch against rootkits.
It is a bit boring when you use it in a often updated Gentoo system, because when you emerge watched files (see 'rkhunter --list propfiles'), rkhunter detect false positives.

I wrote a simple portage hook to keep rkhunter updated when a watched file is updated. It works for me.

[cboldt]

Thanks for that. I expect some will chime in with other ways to skin the cat. I have some ideas myself, but in this case I am going to be a slight contrarian.

I like that rkhunter reports these false positives" to me. rkhunter has, from time to time, stopped working altogether, and without much in the way of notice. I am more likely to notice this failure if I recall emerging a watched file, and not getting a report from rkhunter - or getting an rkhunter report on one machine but not another.

[hujuice]

[cboldt]

I only update once a week, but agree, daily updating of rkhunter database across half a dozen systems would get tiresome.

I would be tempted to take an easy way out, putting a wrapper around the emerge update.

[hujuice]