[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: /boot partition changes when it should not



Clive McBarton wrote:
OK, I studied the tune2fs manpage. I found that it controls what happens
when a certain mount count or mount interval is reached. Which requires
mount count and time to be already stored in the filesystem. What I need
is not to prevent the reaction to this data (count and time). What I
need is to prevent this data to be updated in the first place during
mount while booting.

Yep, I just read that :/.
I'm not sure why it's absolutely needed, maybe it would be acceptable to ask for a new little switch.

The question is, then, as usual;  why is it important?

It detects malicious tampering with the boot system.

"It"? You mean a rootkit detection tool or something? Is it some kind of offline system you plug-in to boot the system after doing some basic checks?

Anyway, you should use a smarter tool, I guess, one that can understand the filesystem and checksum the files inside, not the entire volume.

Or hack ext3.

-thib


Reply to: