rkhunter warn me after a "sudo firecfg"

[ghost]

Hello,

Is that normal that all those binary are modified after a "sudo firecfg" ? Why ?

Thx for your help :)

[rusty-snake]

Is that normal that all those binary are modified after a "sudo firecfg" ? Why ?

The binaries itself are installed under /usr/bin and do not get modified. What happens here is that firecfg creates symlinks to firejail which the names of the binaries in a directory in $PATH with a higher order than /usr/bin (read it's documentation for more details) so you execute firejail instead of ssh if you type ssh. firejail then detects that it was started through a symlink named ssh and starts ssh in a sandbox.

TL;DR: Totally normal.

You can check if you can configure rkhunter to skip /usr/local/bin to check the actual binaries.

[ghost]

Thank you for your answer, have a nice day.

[rusty-snake]

FYI #5236