So apparently prelink was running.
I disabled it in /etc/sysconfig/prelink and ran 'prelink -ua' to undo the linking.
I just stumbled upon a document (attached) describing how Linux used to have a.out and now the ELF.
Though I never knew that prelink actually modifies the files and thought of it as a cache library or something. Literally modifies!!
So, I assume the problem is solved as ls seems to have reverted back but if not then it may be an LKM kit :|
On Mon, Sep 26, 2011 at 6:29 AM, Rob Kampen <rkampen@xxxxxxxxxxxxxxxxx> wrote:
Jeremy Sanders wrote:Any comments or thoughts from the list as to the benefit of prelink?
Micky L Martin wrote:
Because rpm and rpmverify also seemed to have been modified so I cannot
trust 'rpm -V' package verification.
Already did lsof and process tracing but to no avail. Does anyone have any
idea how to find that culprit?
Are you sure it's not prelink that's modifying the files? You can google how to disable this.
does the system performance change if this is disabled?
It causes issues with aide also.
Boot from a CD to check the checksums or run rpm if you want a clean environment.
Jeremy
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
_______________________________________________ CentOS mailing list CentOS@xxxxxxxxxx http://lists.centos.org/mailman/listinfo/centos
