After a nightly rkhunter --cronjob run I got a "Suspect files: 4" line in the report. Rootkit checks came back clean (0 rootkits, 498 checked), but four hidden paths were flagged as potentially suspicious:

  • /usr/.qwen
  • /dev/shm/PostgreSQL.*
  • /root/.local/bin/env
  • /usr/bin/.summarizer-*

I panicked for about ten minutes, then realized every single one was something I put there myself:

  • /usr/.qwen is a model cache directory a local Qwen run created.
  • /dev/shm/PostgreSQL.* is Postgres using a tmpfs mount for shared memory — completely normal, it just happens to look like a "hidden file in /dev/shm".
  • /root/.local/bin/env is a tiny wrapper script I dropped in my own bin.
  • /usr/bin/.summarizer-* is a temp binary my summarizer helper writes while it runs.

The point: rkhunter's "suspect files" check is a heuristic, not a verdict. It flags anything that looks hidden or unusual, and self-hosters are exactly the kind of people who have dotfiles, tmpfs mounts and helper scripts everywhere. A flagged path is a prompt to investigate, not to assume compromise.

The right move is to whitelist the ones you own and can account for, then re-run the property update so the noise goes away:

# /etc/rkhunter.conf ALLOWHIDDENDIR="/usr/.qwen" ALLOWHIDDENFILE="/dev/shm/PostgreSQL.*" ALLOWHIDDENFILE="/root/.local/bin/env" ALLOWHIDDENFILE="/usr/bin/.summarizer-*"

Then:

rkhunter --propupd

After that the next --cronjob run reports 0 suspects, and anything NEW that shows up is actually worth your attention — which is the whole reason to keep rkhunter running in the first place. The signal is only useful once you've cleared your own noise.

Full write-up (including how I verified each path was legit before whitelisting): https://igornews.com/2026/11/08/rkhunter-false-positives-whitelist/