Suspicious file /dev/shm/ShM.c5fa4b64H8dd08c52

[Dan Liebner <dl...@gmail.com>]

This file `/dev/shm/ShM.c5fa4b64H8dd08c52` seems to be created by apache2
according to my audit log. It goes away when apache2 is stopped. It
originally showed up in a rkhunter scan. I can't find any information about
it online except for similar reports. Is this likely a legitimate file
created by apache or possibly malware of some kind?

Thanks,
Dan

Re: Suspicious file /dev/shm/ShM.c5fa4b64H8dd08c52

[Dan Liebner <dl...@gmail.com>]

My mistake, thanks for the tip! Okay, great, glad to hear it's expected
behavior.

Best,
Dan

On Sun, Mar 10, 2024 at 7:35 PM Daniel Gruno <hu...@apache.org> wrote:

> On 3/10/24 21:02, Dan Liebner wrote:
> > This file `/dev/shm/ShM.c5fa4b64H8dd08c52` seems to be created by apache2
> > according to my audit log. It goes away when apache2 is stopped. It
> > originally showed up in a rkhunter scan. I can't find any information
> about
> > it online except for similar reports. Is this likely a legitimate file
> > created by apache or possibly malware of some kind?
> >
> > Thanks,
> > Dan
> >
>
> Hi, Dan,
>
> You should probably contact users@httpd.apache.org if you have httpd
> related questions in the future. For what it's worth, SHM refers to
> "shared memory", and /dev/shm/ is used for storing pointers to memory
> that is to be shared between two applications (in this case, between the
> various root/worker processes in httpd)
>
> With regards,
> Daniel.
>

Re: Suspicious file /dev/shm/ShM.c5fa4b64H8dd08c52

[Daniel Gruno <hu...@apache.org>]

On 3/10/24 21:02, Dan Liebner wrote:
> This file `/dev/shm/ShM.c5fa4b64H8dd08c52` seems to be created by apache2
> according to my audit log. It goes away when apache2 is stopped. It
> originally showed up in a rkhunter scan. I can't find any information about
> it online except for similar reports. Is this likely a legitimate file
> created by apache or possibly malware of some kind?
> 
> Thanks,
> Dan
> 

Hi, Dan,

You should probably contact users@httpd.apache.org if you have httpd 
related questions in the future. For what it's worth, SHM refers to 
"shared memory", and /dev/shm/ is used for storing pointers to memory 
that is to be shared between two applications (in this case, between the 
various root/worker processes in httpd)

With regards,
Daniel.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@community.apache.org
For additional commands, e-mail: dev-help@community.apache.org