[cobalt-security] Question about files left after SHP Removal 2.0.1

["Steve Werby" <steve-lists@xxxxxxxxxxxx>]

I was recently working on a client's RaQ4 which had the SHP package
installed.  The client said he installed the SHP Removal 2.0.1 package from
the GUI, but SHP still showed in the installed software list so I tried
installing SHP Removal 2.0.1 from the shell and got the following error.

[root packages]# /usr/local/sbin/cobalt_upgrade
RaQ4-en-Security-2.0.1-SHP_REM.pkg
cannot get shared lock on database
4015 Problem removing SHP component(s):base-scandetection-misc sgalertd
pafmgr fwall-kernel
4015 Error in installation script upgrade_me

I then unpacked the PKG file, saw that it installed 2 RPMs, checked and they
were installed, saw that it removed 4 RPMs, checked and they were removed
and saw that it removed 2 directories and a file, checked and /etc/overflow
was already gone, but I had to remove /var/log/phoenix.log and
/etc/scandetection manually.  I noticed that the following were still
installed and presumably part of SHP (correct me if I'm wrong):

/usr/sbin/testoverflow
/usr/admserv/cgi-bin/.cobalt/overflow (a directory)

I don't have access to another RaQ4 which had SHP installed and has run the
SHP Removal 2.0.1 package, so I'm hoping that someone who has done so
successfully can check whether the file and directory above should have been
deleted.  My guess is they should be, but I don't see anything related to
them in SHP Removal 2.0.1 and without access to the original SHP package I'm
not sure they're part of the specific RPMs which were removed by SHP Removal
2.0.1.  Thanks!

--
Steve Werby
President, Befriend Internet Services LLC
http://www.befriend.com/