diff -Nur rkhunter-1.4.2.orig/files/rkhunter rkhunter-1.4.2/files/rkhunter --- rkhunter-1.4.2.orig/files/rkhunter 2014-03-12 14:54:55.000000000 -0600 +++ rkhunter-1.4.2/files/rkhunter 2014-04-06 11:39:44.776583858 -0600 @@ -13964,11 +13964,11 @@ touch "${IPCS_TMPFILE}" FOUND=0; echo $FOUND > "${IPCS_TMPFILE}" - if [ `${IPCS_CMD} -u 2>/dev/null | awk -F' ' '/segments allocated/ {print $3}'` -ne 0 ]; then - ${IPCS_CMD} -m | grep "^0x" | while read RKH_SHM_KEY RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_PERMS RKH_SHM_BYTES RKH_SHM_NATTACH RKH_SHM_STATUS; do + if [ `LC_ALL=C ${IPCS_CMD} -u 2>/dev/null | awk -F' ' '/segments allocated/ {print $3}'` -ne 0 ]; then + LC_ALL=C ${IPCS_CMD} -m | grep "^0x" | while read RKH_SHM_KEY RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_PERMS RKH_SHM_BYTES RKH_SHM_NATTACH RKH_SHM_STATUS; do if [ $RKH_SHM_PERMS -eq 666 -a $RKH_SHM_BYTES -ge 1000000 ]; then FOUND=1; echo $FOUND > "${IPCS_TMPFILE}" - ${IPCS_CMD} -p | grep "^${RKH_SHM_SHMID}" | while read RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_CPID RKH_SHM_LPID; do + LC_ALL=C ${IPCS_CMD} -p | grep "^${RKH_SHM_SHMID}" | while read RKH_SHM_SHMID RKH_SHM_OWNER RKH_SHM_CPID RKH_SHM_LPID; do RKH_SHM_PATH=`${READLINK_CMD} -f /proc/${RKH_SHM_CPID}/exe` if [ $VERBOSE_LOGGING -eq 1 ]; then display --to LOG --type PLAIN --result FOUND --log-indent 2 ROOTKIT_MALWARE_IPCS_DETAILS "${RKH_SHM_PATH}" "${RKH_SHM_CPID}" "${RKH_SHM_OWNER}"