Re: files which change during normal execution
On Tue, Aug 12, 2003 at 07:49:47AM -0400, Mehta, Rohit wrote:
>
> Hi I am configuring tripwire for one of our Debian servers, and am puzzled by some files
> which change modification time during reboot.
>
> Included are:
> /lib/modules/2.2.20-idepci/modules.dep
> /lib/modules/2.2.20-idepci/modules.generic_string
> ...some other modules...
> /lib/modules/2.2.20-idepci/modules.usbmap
>
> The data (md5 checksum), filesize, inode, etc have all remained static, but the modification
> time has changed on the reboot. I did not update any modules, so I am wondering what the
> issue is here. I certainly would like to know if someone replaces my modules with evil backdoor
> modules.
>
> Should I be concerned about the updating modification times?
No, it's perfectly normal. Upon rebooting, you see a line 'Calculating
module dependencies...' or something like that. The modules* files are
regenerated right then. However, if you didn't add any new modules
before the reboot, the resultant file is identical to the original file.
Hence, no size and md5sum changes.
BTW, IIUC, tripwire should warn you about replaced modules.
David
Reply to: