[GH-ISSUE #5236] rkhunter detects possible rootkit in /usr/local/bin/ping

gitea-mirror commented

2026-05-05 09:35:35 -06:00

Owner

Originally created by @samsamros on GitHub (Jul 5, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5236

I'm using a Debian based distro called Parrot OS.
firejail version 0.9.64.4

This needs the hardened ping profile. (ping-hardened.inc.profile ping.profile), and symlinks up (sudo firecfg).
Run rkhunter -c -sk
Rootkit checks...
Rootkits checked : 477
Possible rootkits: 7
Rootkit names : Ping Rootkit or other backdoor
Warning: Checking for possible rootkit strings [ Warning ]
Found string '/bin/bash' in file '/usr/local/bin/ping'. Possible rootkit: Ping Rootkit or other backdoor

Expected behavior

After running several tests and turning off my system as a precaution, I ran tests on several other computers with this operating system.
Several considerations here: a) all systems are personal computers, b) none have open ports facing the web directly as a service.

I reviewed another computer which is also a personal laptop running Parrot OS. The same possible rootkit appeared. I did much research and couldn't find a bug anywhere or information on the rootkit directly. After purging firejail and reinstalling profiles and the software itself the warning was gone (as the symlinks were gone). I also noticed that the ping hardened version was gone as of July 4th, 2022. I also confirmed this was an actual profile and not product of a possible intrusion: #5184

Behavior without a profile

I used a friend's system who is unrelated to my network and who I seldom share any information with. He also uses Parrot OS as a desktop distro (no ports with services facing the web directly).
He had firejail installed, same version (0.9.64.4), and he also had the ping hardened profile included in /etc/firejail but had not run sudo firecfg after installing the software a few months back. He ran rkhunter -c -sk and the following came out:
Rootkit checks...
Rootkits checked : 477
Possible rootkits: 6 (all of which are confirmed false positives, no worries)

I ran sudo firecfg and then re-ran rkhunter -c -sk and the following came out:
Rootkit checks...
Rootkits checked : 477
Possible rootkits: 7
Rootkit names : Ping Rootkit or other backdoor
Warning: Checking for possible rootkit strings [ Warning ]
Found string '/bin/bash' in file '/usr/local/bin/ping'. Possible rootkit: Ping Rootkit or other backdoor

After purging the installation on his computer and reinstalling default profiles and the software (which does not include the ping hardened version), the warning is gone.

In another laptop with a clean Parrot OS install (which was installed and fully updated in July 1st, 2022) I also ran sudo firecfg and saw the hardened version was not included anymore. As expected, no possible ping rootkit was registered by rkhunter.

I'm certain this is a bug as it happened in three different computers, one of which is completely unrelated to mine. However, I wanted to leave this here in case this might be helpful to other users or if more experienced users/devs run into this and are certain it might actually be something worth looking into.

Originally created by @samsamros on GitHub (Jul 5, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5236 I'm using a Debian based distro called Parrot OS. firejail version 0.9.64.4 1. This needs the hardened ping profile. (ping-hardened.inc.profile ping.profile), and symlinks up (sudo firecfg). 2. Run `rkhunter -c -sk` Rootkit checks... Rootkits checked : 477 Possible rootkits: 7 Rootkit names : Ping Rootkit or other backdoor Warning: Checking for possible rootkit strings [ Warning ] Found string '/bin/bash' in file '/usr/local/bin/ping'. Possible rootkit: Ping Rootkit or other backdoor ### Expected behavior After running several tests and turning off my system as a precaution, I ran tests on several other computers with this operating system. Several considerations here: a) all systems are personal computers, b) none have open ports facing the web directly as a service. I reviewed another computer which is also a personal laptop running Parrot OS. The same possible rootkit appeared. I did much research and couldn't find a bug anywhere or information on the rootkit directly. After purging firejail and reinstalling profiles and the software itself the warning was gone (as the symlinks were gone). I also noticed that the ping hardened version was gone as of July 4th, 2022. I also confirmed this was an actual profile and not product of a possible intrusion: #5184 ### Behavior without a profile I used a friend's system who is unrelated to my network and who I seldom share any information with. He also uses Parrot OS as a desktop distro (no ports with services facing the web directly). He had firejail installed, same version (0.9.64.4), and he also had the ping hardened profile included in /etc/firejail but had not run `sudo firecfg` after installing the software a few months back. He ran `rkhunter -c -sk` and the following came out: Rootkit checks... Rootkits checked : 477 Possible rootkits: 6 (all of which are confirmed false positives, no worries) I ran `sudo firecfg` and then re-ran `rkhunter -c -sk` and the following came out: Rootkit checks... Rootkits checked : 477 Possible rootkits: 7 Rootkit names : Ping Rootkit or other backdoor Warning: Checking for possible rootkit strings [ Warning ] Found string '/bin/bash' in file '/usr/local/bin/ping'. Possible rootkit: Ping Rootkit or other backdoor After purging the installation on his computer and reinstalling default profiles and the software (which does not include the ping hardened version), the warning is gone. In another laptop with a clean Parrot OS install (which was installed and fully updated in July 1st, 2022) I also ran `sudo firecfg` and saw the hardened version was not included anymore. As expected, no possible ping rootkit was registered by rkhunter. I'm certain this is a bug as it happened in three different computers, one of which is completely unrelated to mine. However, I wanted to leave this here in case this might be helpful to other users or if more experienced users/devs run into this and are certain it might actually be something worth looking into.

gitea-mirror

2026-05-05 09:35:35 -06:00

closed this issue
added the
notourbug
label

gitea-mirror commented

2026-05-05 09:35:38 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 5, 2022):

#5234

@rusty-snake commented on GitHub (Jul 5, 2022): #5234

gitea-mirror commented

2026-05-05 09:35:38 -06:00

Author

Owner

@samsamros commented on GitHub (Jul 5, 2022):

#5234

thank you for your quick response, and taking the time to look at this. I have seen rkhunter goes through these paths, and will configure it to handle them differently. However, it is the first time a rootkit warning has resulted from one of these paths in my case

Is it safe to say that the rootkit warning in the /usr/local/bin/ping is a false positive related to firejail?

@samsamros commented on GitHub (Jul 5, 2022): > #5234 thank you for your quick response, and taking the time to look at this. I have seen rkhunter goes through these paths, and will configure it to handle them differently. However, it is the first time a rootkit warning has resulted from one of these paths in my case Is it safe to say that the rootkit warning in the /usr/local/bin/ping is a false positive related to firejail?

gitea-mirror commented

2026-05-05 09:35:39 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 5, 2022):

Is it safe to say that the rootkit warning in the /usr/local/bin/ping is a false positive related to firejail?

If it happens on different systems, sure.

The main question for me is how does this rootkit check work and why does it only trigger for the ping symlink?

@rusty-snake commented on GitHub (Jul 5, 2022): > Is it safe to say that the rootkit warning in the /usr/local/bin/ping is a false positive related to firejail? If it happens on different systems, sure. The main question for me is how does this rootkit check work and why does it only trigger for the ping symlink?

gitea-mirror commented

2026-05-05 09:35:40 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jul 5, 2022):

The main question for me is how does this rootkit check work and why does it only trigger for the ping symlink?

Actually the warning already states it: Found string '/bin/bash' in file '/usr/local/bin/ping'
If this is the only reason to mark it as rootkited there is nothing to worry about.

@rusty-snake commented on GitHub (Jul 5, 2022): > The main question for me is how does this rootkit check work and why does it only trigger for the ping symlink? Actually the warning already states it: `Found string '/bin/bash' in file '/usr/local/bin/ping'` If this is the only reason to mark it as rootkited there is nothing to worry about.

gitea-mirror commented

2026-05-05 09:35:41 -06:00

Author

Owner

@reinerh commented on GitHub (Jul 5, 2022):

The main question for me is how does this rootkit check work and why does it only trigger for the ping symlink?

It's looking specifically for /bin/bash only for ping:
https://sources.debian.org/src/rkhunter/1.4.6-10/files/rkhunter/#L9584

@reinerh commented on GitHub (Jul 5, 2022): > The main question for me is how does this rootkit check work and why does it only trigger for the ping symlink? It's looking specifically for `/bin/bash` only for ping: https://sources.debian.org/src/rkhunter/1.4.6-10/files/rkhunter/#L9584

gitea-mirror commented

2026-05-05 09:35:41 -06:00

Author

Owner

@samsamros commented on GitHub (Jul 5, 2022):

thank you @rusty-snake and @reinerh !
I think this settles the matter, and I hope other users who may run into this find this helpful.

@samsamros commented on GitHub (Jul 5, 2022): thank you @rusty-snake and @reinerh ! I think this settles the matter, and I hope other users who may run into this find this helpful.

gitea-mirror commented

2026-05-05 09:35:42 -06:00

Author

Owner

@kmk3 commented on GitHub (Jul 5, 2022):

@samsamros Please consider reporting this as a false positive to rkhunter (and
linking to this issue), so that they (and potentially other affected users) are
made aware of it.

@kmk3 commented on GitHub (Jul 5, 2022): @samsamros Please consider reporting this as a false positive to rkhunter (and linking to this issue), so that they (and potentially other affected users) are made aware of it.

gitea-mirror commented

2026-05-05 09:35:43 -06:00

Author

Owner

@samsamros commented on GitHub (Jul 5, 2022):

@kmk3 will do!
thank you

@samsamros commented on GitHub (Jul 5, 2022): @kmk3 will do! thank you

gitea-mirror referenced this issue

2026-05-05 10:22:56 -06:00

[PR #2929] [MERGED] seccomp fix: allow numeric syscalls #4589