chkrootkit(8)

✨ NAME ✨

okay so bestie, this is chkrootkit(8) — the manual page for the tool that scans your system for signs of rootkits, and honestly? it's giving security-bestie energy. 💖

🌸 SYNOPSIS 🌸

chkrootkit [OPTIONS] [TEST...]

🦋 DESCRIPTION 🦋

So chkrootkit examines the target system for signs that it has been tampered with. Lowkey detective work, fr fr. 🔍

Some tools which chkrootkit uses can be found in /usr/lib/chkrootkit. That's where the little helper besties live. 🏠✨

---

💅 OPTIONS 💅

Okay so first, a very important heads-up: unlike usual programmes, options cannot be 'combined', so you need to write -q -n instead of -qn. No smooshing them together, she needs her space. 🙅‍♀️

• -q — Enter quiet mode. This suppresses output of tests that find nothing suspicious. Basically "if you have nothing shady to report, say nothing." ✨
• -x — Enter expert mode. This makes many tests produce additional output showing what they have found. She's spilling everything now. 💅
• -d — Enter debug mode. This shows exactly what chkrootkit is doing at every step (it includes running chkrootkit with set -x). Max transparency, no secrets. 👑
• -e "FILE1[ FILE2...]" — Exclude listed files from the results of some tests. The list should be space-separated (which will generally require quoting when run from a shell). You can also specify -e several times. Use this to remove false positives from the result of many tests — see /usr/share/doc/chkrootkit/README.FALSE-POSITIVES.gz. Not everything suspicious is actually suspicious, bestie, sometimes it's just your weird little file. 🍓
• -s REGEXP — Similar to -e but only applies to the result of the sniffer test. This test will class standard network managers like systemd-networkd(1), NetworkManager(1) or wpa_supplicant(1) as packet sniffers. You can remove such messages from the output with something like chkrootkit -s '(systemd-networkd|NetworkManager|wpa_supplicant)' (you may want to use a more precise regular expression, see /etc/chkrootkit/chkrootkit.conf). The argument can be any regular expression understood by egrep(1) and is applied to every line of the output of the ifpromisc test. Regex girlies, this one's for you. 🧚
• -p DIR1[:DIR2...] — Specify an alternative $PATH. chkrootkit assumes that standard programmes, like find(1) and grep(1), are uncompromised. The intention is that you place trusted copies of such binaries where they cannot be modified and invoke with something like chkrootkit -p /media/usb. Trusted binaries only, no suspicious randos. 🛡️
• -r DIR — Use DIR as the root directory. For example, you might mount a compromised disk on an uncompromised system and run chkrootkit -r /mnt. Investigating your messy ex from a safe distance, iconic. 🔍
• -n — make some tests ignore NFS-mounted directories. NFS stays out of it. 🙈
• -T FSTYPE — make some tests ignore file systems of type FSTYPE. This uses find(1)'s -fstype option. Selective vision, but make it intentional. ✨
• -l — Print available tests. Show me the menu, queen. 📜
• -h — Print a short help message and exit. Little help, no commitment. 🫶
• -V — Print version information and exit. Who are you, bestie? 🌈

heads-up: that -e/-s exclusion stuff is genuinely about quieting false positives — don't use it to silence a test that's telling you something real. 💀

---

🎀 AUTHOR 🎀

Manual page written by Yotam Rubin <yotam@makif.omer.k12.il>, Marcos Fouces <marcos@debian.org>, Lantz Moore <lmoore@debian.org>, and Richard Lewis <richard.lewis.debian@googlemail.com> for the Debian project. It may be used by others. Legends, all of them. 👑

---

⭐ SEE ALSO ⭐

strings(1) chklastlog(8) chkwtmp(8)

---

and that's the whole vibe check, bestie — this page is from the System Manager's Manual, dated Oct 23, 2021 💖 stay safe, scan often, and remember: not everything weird is a rootkit, sometimes it's just networking being networking. 🦋✨