On 10/11/2015 11:38 PM, Jan Zelený wrote:
On 9. 10. 2015 at 03:54:51, Bond Masuda wrote:
hello,
i'm working on a file monitoring system and I'm noticing files like the
following example being created and then disappearing:
/usr/share/zoneinfo/right/Europe/Zurich;56177f7a
/usr/share/zoneinfo/right/Europe/Bratislava;56177f7a
/usr/share/zoneinfo/right/Europe/Prague;56177f7a
/usr/share/zoneinfo/right/Europe/Belgrade;56177f7a
/usr/share/zoneinfo/right/Europe/Ljubljana;56177f7a
/usr/share/zoneinfo/right/Europe/Podgorica;56177f7a
/usr/share/zoneinfo/right/Europe/Sarajevo;56177f7a
/usr/share/zoneinfo/right/Europe/Skopje;56177f7a
/usr/share/zoneinfo/right/Europe/Zagreb;56177f7a
/usr/share/zoneinfo/right/Europe/Belfast;56177f7a
/usr/share/zoneinfo/right/Europe/Guernsey;56177f7a
/usr/share/zoneinfo/right/Europe/Isle_of_Man;56177f7a
/usr/share/zoneinfo/right/Europe/Jersey;56177f7a
/usr/share/zoneinfo/right/Europe/London;56177f7a
/usr/share/zoneinfo/right/GB;56177f7a
/usr/share/zoneinfo/right/GB-Eire;56177f7a
/usr/share/zoneinfo/right/Etc/UTC;56177f7a
/usr/share/zoneinfo/right/Etc/Universal;56177f7a
/usr/share/zoneinfo/right/Etc/Zulu;56177f7a
/usr/share/zoneinfo/right/UTC;56177f7a
The sample above happened during a tzdata package update. Does rpm
create these files and then moves them to destination (over the old file
during an update)? Or, does it move the old file to files in the format
above and then deletes them when the new file install is completed? If
so, how does it determine the "suffix" string, like ";56177f7a" in the
above samples? Is it randomly generated? What's the nature of this
suffix string? Is it always 8 characters wide? it seems to allow for
alphanumeric characters, but does that include capital letters? Are any
other characters allowed in the suffix string?
If I can understand this better, I can write rules to categorize them as
being part of some RPM activity. Just need to understand what they are,
and what kind of patterns I can look for.
Thanks,
Bond
Hi Bond,
this has nothing to do with rpm itself, it's the package which is creating
these files in its %post script. You should direct your question at the
maintainer of that package in your distro.
Thanks
Jan
Hi Jan,
Is this a very common practice by package maintainers? Because I'm
seeing the same behavior on many other RPM packages, like bwm-ng,
openldap, selinux-policy, glibc, glibc-common, for example. This is on
CentOS 6.7. This is not unique to the tzdata packages that I mention as
an example in my OP. Here are a few more samples, and I can provide
plenty more:
/etc/openldap/ldap.conf;560b8a5f
/lib64/liblber-2.4.so.2;560b8a5f
/lib64/liblber-2.4.so.2.10.3;560b8a5f
/lib64/libldap-2.4.so.2;560b8a5f
/lib64/libldap-2.4.so.2.10.3;560b8a5f
/lib64/libldap_r-2.4.so.2;560b8a5f
/lib64/libldap_r-2.4.so.2.10.3;560b8a5f
/lib64/libldif-2.4.so.2;560b8a5f
/lib64/libldif-2.4.so.2.10.3;560b8a5f
/usr/libexec/openldap/create-certdb.sh;560b8a5f
/usr/share/doc/openldap-2.4.40/ANNOUNCEMENT;560b8a5f
/usr/share/doc/openldap-2.4.40/CHANGES;560b8a5f
/usr/share/doc/openldap-2.4.40/COPYRIGHT;560b8a5f
/usr/share/doc/openldap-2.4.40/LICENSE;560b8a5f
/usr/share/doc/openldap-2.4.40/README;560b8a5f
/usr/share/man/man5/ldap.conf.5.gz;560b8a5f
/usr/share/man/man5/ldif.5.gz;560b8a5f
Are you absolutely sure this is not from RPM? perhaps a lower level api
that RPM uses that creates these files?
Bond
_______________________________________________
Rpm-list mailing list
Rpm-list@xxxxxxxxxxxxx
http://lists.rpm.org/mailman/listinfo/rpm-list
