Hi,

recently rkhunter started to complain about files in /dev/shm/run


Warning: Suspicious file types found in /dev:
/dev/shm/run/zenworks/.sqlanywhere12/sasrv.ini: ASCII text
/dev/shm/run/nscd/group: data
/dev/shm/run/nscd/passwd: data
/dev/shm/run/nscd/services: data
/dev/shm/run/ConsoleKit/database: ASCII text
Warning: Hidden directory found: /dev/shm/run/zenworks/.sqlanywhere12


It started after the latest kernel update on SLES 11:

uname -a
Linux zcm11-2 3.0.101-0.40-default #1 SMP Thu Sep 18 13:09:38 UTC 2014
(44b8c95) x86_64 x86_64 x86_64 GNU/Linux

but what seems strange to me: I updated some of my servers, rebooted - and
rkhunter does not complain. About one or two weeks later I upgraded the
other servers - now rkhunter complaines on these servers.

To me it looks like as if what was in /var/run has changed to /dev/shm/run

I don't find anything about /dev/shm/run with google - anybody knows what it
is about with /dev/shm/run ?

Thanks,
Mirko