I realize
Blockquote
rkhunter
isn’t the most robust 
but I like it.
When I upgraded from 15.6 to 16.0, it gave all kinds of grep/egrep warnings.
Found a solution that changed them with grep -E
SOLVED: RKHUNTER: patch for egrep
However,
Blockquote
sudo rkhunter --check
gives me warning, that won’t go away with
Blockquote
sudo rkhunter --propupd
–or–
sudo rkhunter --propupd /usr/bin/rkhunter
Which is what I discerned from the man page.
What to do?
And the warning is?
Hi, it basically tracks things about important files, then reports if it’s changed – time, size, whatever.
/usr/bin/rkhunter [ Warning ]
If was OK, “warning” would say “OK”
The “propupd” option basically says the current info is OK and it updates the info about the files it’s tracking.
After an Update, you’d get warnings on all the changed programs, files, etc.,
so you’d run the propupd because it’s expected.
The next time you run, all the 'warnings" would be “OK”.
It’s not happening in this case.
When it’s unexpected, someone or something has messed with you system.
In theory, anyhow.
Maybe rkhunter can’t write into its database. This might be due to SELinux or Apparmor. Or something other is broken which could be found by using the --debug flag.
As rkhunter is unmaintained upstream since 2018, is kinda useless and has unpatched security issues, it got removed from Tumbleweed and Factory. Unfortunately this happened after release of Leap 16, and an unmaintained package landed in Leap.
You may need to open a bugreport with --debug data to draw some attention from the SUSE/openSUSE maintainers.
Yes to All.
But just as someone fixed the grep/egrep problem when they upgraded their SuSE
I’m just hoping someone did the same with this.
So I won’t be marking this resolved to give them a chance to see & help.
I’ll not be reporting this as a SuSE problem (just sending up a flare for others).
Thank you so very much not only for your response, but it’s quickness and thoroughness.