Thanks. Yes, prelink seems to have actually been changing the files. After running prelink to revert its actions the files and their checksums returned to normal. Enabling/Disabling prelink can be accomplished by setting, respectively, yes or no for PRELINKING in /etc/sysconfig/prelink and executing the script /etc/cron.daily/prelink. Wiktor On Sat, 10 Mar 2007, Dennis Gilmore wrote: > Once upon a time Saturday 10 March 2007, Wiktor Rzeczkowski wrote: > > I did some testing of RHEL v.4 U4 AS, FC3, FC5 and FC6 and seem to have > > been finding that, soon after a fresh installation of the OS on a > > non-networked machine, many files were automatically changing. I also seem > > to have been finding that some time after package update, the files were > > automatically changing again. > > > > /bin/ls is one of the files that were changing. The file is part of > > coreutils package. The following are MD5 checksums for /bin/ls on the > > specified RHEL and FC systems immediately after installation of the > > specified coreutils package (current version). The checksums are computed > > by 'md5sum /bin/ls' and the versions of OS and of coreutils are displayed > > by 'cat /etc/redhat-release' and 'rpm -q coreutils' (no quotes), > > respectively. > what you are seeing is prelink in action. from prelink's man page > > prelink is a program which modifies ELF shared libraries and ELF dynamically > linked binaries, so that the time which dynamic linker needs for their > relocation at startup significantly decreases and also due to fewer > relocations the run-time memory consumption decreases too (especially number > of unshareable pages). Such prelinking information is only used if all > its dependant libraries have not changed since prelinking, otherwise programs > are relocated normally. > > you are free to disable prelink if you want. > > Dennis > -- Fedora-security-list mailing list Fedora-security-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-security-list
