Re: /boot partition changes when it should not
Clive McBarton <clivemcbarton@web.de> writes:
>Stephen Powell wrote:
>> For example, the boot loader may be updating the mount
>> count or updating the "last referenced date/time", if there is such
>> a field in the filesystem, for the kernel image or the initial RAM
>> disk image.
>I assume you mean "atime", which exists in ext3. And no, it was not
>updated. I checked with ls, it has the same value it had since the last
>kernel update.
An ext3 filesystem has a last mount time in the superblock. This is
different to any of the POSIX times in the root directory of the
filesystem. The Linux kernel does not update this field on a read-only
mount.
If it were me trying to diagnose this, I would be diffing the images
that should be the same and seeing where they are different. There's
plenty of info out there on the data structures of the ext3 filesystem,
so it shouldn't be too difficult to determine which attributes or other
parts of the filesystem are being modified.
At that point, then you can start speculating on what application is
making the modification. Trying to guess what is making the modifications
without knowing what was modified is going about it backwards.
Reply to: