http://bugzilla.suse.com/show_bug.cgi?id=904544 --- Comment #1 from Dirk Weber --- There is also a problem with the check_sysctl () functionality which makes the output much more difficult to evaluate than necessary. The function check_sysctl () in the file security_daily_helper.inc already outputs a diff result which is then again processed with diff in send_daily_changes () in file helper.inc. This results in output like this included in the daily mail report: - + net.netfilter.nf_conntrack_count = 70 + - net.netfilter.nf_conntrack_count = 70 These values are actually the same and I think they should not be in the daily report at all. As there are usually lots of "same" lines like these, sometimes several lines apart, which require filtering by the user it could cause that a critical change is missed. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=904544 Dirk Weber changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #612901|0 |1 is obsolete| | --- Comment #2 from Dirk Weber --- Created attachment 613058 --> http://bugzilla.suse.com/attachment.cgi?id=613058&action=edit improved patch which also addresses the double diff of the sysctl output This second patch contains some corrections for the original patch. Additionally it removes the "diff" of the output of sysctl from security_daily_helper.inc so that the diff in helper.inc gets unprocessed input and can filter out unchanged lines. This makes the daily mails much shorter and easier to judge if something is fishy. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=904544 --- Comment #13 from Dirk Weber --- you are right, the creation of $output_file in check_sysctl() should be removed. In function check_no_plus () also an unused $ouput_file is created and not deleted: local output_file=`mktemp -t check_no_plus.XXXX` # TEMPDIR is set but not exported.. does it work? But on my system I do not have these files left over, probably they are removed by some tmpdir cleanup mechanism. -- You are receiving this mail because: You are on the CC list for the bug.