Among other measures, we have rkhunter going on a couple of servers.
rkhunter on both servers reported a "suspicious file". Specifically:
Warning: Suspicious file types found in /dev: /dev/shm/R1Soft-SHM-ZocPNFWuCcEl2rrN: data
This corresponds to a regular package update to R1Soft from just before this alert appeared. However, rpm -qf indicates that this file is not owned by any package.
I am reasonably satisfied that this is a false positive, given that the timing corresponds with a package update of a piece of mainstream software, and it did so identically on two unconnected servers. The bit of doubt I have is really that a few days have gone by, and I don't see anybody else reporting the same issue.
My main question is:
What sort of steps can we take to definitively verify that this is a false positive?
If we can do that, I would happily white-list it in rkhunter.