Re: [CentOS] Several files's checksum change without reason

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



On Sat, 2006-08-12 at 23:15 +0200, kadafax wrote:
> William L. Maltby wrote:
> > On Sat, 2006-08-12 at 19:10 +0200, kadafax wrote:
> >   
> >><snip>

> >> ... several changes on files who were not (at first 
> >> sight) affected by a recent update (the list is below).
> >> Is there a logic explanation for those changes to happen ? The "rpm -Va" 
> >> command does not output md5sum change for those files.
> >>     
> >
> > Date/time looks like it might be a cron scheduled event. My bet is
> > prelink. Have you looked at the crontabs and/or logs?
> >   
> prelink appears there:
> [root@server cron]# ll /etc/cron.daily/
> total 76
> lrwxrwxrwx  1 root root   28 Jun 29 20:27 00-logwatch -> 
> ../log.d/scripts/logwatch.pl
> -rwxr-xr-x  1 root root  418 Feb 21  2005 00-makewhatis.cron
> -rwxr-xr-x  1 root root  276 Feb 21  2005 0anacron
> -rwxr-xr-x  1 root root  117 Mar 31  2005 epylog.cron
> -rwxr-xr-x  1 root root  180 Aug 23  2005 logrotate

> -rwxr-xr-x  1 root root 2133 Dec  1  2004 prelink
> -rwxr-xr-x  1 root root  104 Jan  1  2006 rpm
> -rwxr-xr-x  1 root root  121 Aug 22  2005 slocate.cron
> -rwxr-xr-x  1 root root  286 Feb 21  2005 tmpwatch
> -rwxr-xr-x  1 root root  158 Feb 18 15:38 yum.cron
>
> Nothing in logs ( grep cron /var/log/messages*)


$ locate prelink
/etc/prelink.cache

...

/var/log/prelink.log
/var/log/prelink.log.1.bz2

<snip>

> 
> Is it possible for a cron job to modify binary's checksum and inode ?

Yes. If cron is user with proper permissions, ACLs don't prevent and
SELinux doesn't prevent. Cron is (in effect) just another user (may be
root) that runs jobs automatically.

I suggest you investigate the software that may be affecting the systems
you have under your control.

Prelink will change size, date, i-node, ...

> <snip>

-- 
Bill

Attachment: signature.asc
Description: This is a digitally signed message part

_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos

[Index of Archives]     [CentOS]     [CentOS Announce]     [CentOS Development]     [CentOS ARM Devel]     [CentOS Docs]     [CentOS Virtualization]     [Carrier Grade Linux]     [Linux Media]     [Asterisk]     [DCCP]     [Netdev]     [Xorg]     [Linux USB]
  Powered by Linux