Re: /boot partition changes when it should not
On Tue, 9 Mar 2010, Clive McBarton wrote:
umount /boot; mount /boot; dd_rescue /dev/sda1 /tmp/boot1;
umount /boot; mount /boot; dd_rescue /dev/sda1 /tmp/boot2;
diff /tmp/boot1 /tmp/boot2
Hi Clive. I've never used diff to compare binary files.
Is the md5sum of the different files the same?
Result: No change. Hence it does not increment a mount count as long as
it is manually unmounted and remounted while the system is up.
The filesystem sees no distinction between mounting during boot or
mounting any other time. It does increment the mount count. I even went
and confirmed this on one of my systems. Same situation - ext3 /boot.
Use tune2fs -l <filesystem device> to take a look.
Malicious modifying of files with a disk editor is exactly the undesired
stuff that this whole checksumming is supposed to detect.
Why not just use Aide? It's a path of least resistance IMHO and will
produce a better overall result.
To get an absolute, no write, ever, to the device, the OP will need to
figure out how to force read only permissions on the device /dev/sda1,
across boots.
Phantastic idea! Can it be done? I have not heard about this yet. It
would be great.
Well that's a big topic in itself. I think you'd need to get in to
mandatory access controls to do this in an effective way.
Cheers,
Rob
--
Email: robert@timetraveller.org
IRC: Solver
Web: http://www.practicalsysadmin.com
Open Source: The revolution that silently changed the world
Reply to: