Description

Upgrade to Xenial produces a scary ossec syscheck alert:

OSSEC HIDS Notification.
2019 Apr 23 21:57:36

Received From: (app) 10.0.1.4->rootcheck
Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."
Portion of the log(s):

Trojaned version of file '/usr/bin/mail' detected. Signature used: 'bash|file\.h|proc\.h|/dev/[^nu]' (Generic).

 --END OF NOTIFICATION

In this particular case, it seems due to the ruleset alerting on these changes https://askubuntu.com/a/605006

Steps to Reproduce

Using prod vms:

• install 0.12.1 under trusty
• Upgrade the base OS to Xenial
• Observe the ossec alert above

Expected Behavior

• ossec/syscheck alerts should not be triggered on system-provided binaries

Actual behavior

• false-positive ossec/syscheck alert

Comments

1. We should confirm if this is a one-time alert, or if it happens every syscheck run
2. We should see if updating ossec (and thus the ruleset) resolves the issue (there's an older WIP branch here: https://github.com/freedomofpress/securedrop/tree/ossec-3.2)