From owner-freebsd-security  Tue Dec 16 18:45:40 1997
Return-Path: <owner-freebsd-security>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.7/8.8.7) id SAA27267
          for security-outgoing; Tue, 16 Dec 1997 18:45:40 -0800 (PST)
          (envelope-from owner-freebsd-security)
Received: from cheops.anu.edu.au (avalon@cheops.anu.edu.au [150.203.76.24])
          by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id SAA27242
          for <freebsd-security@FreeBSD.ORG>; Tue, 16 Dec 1997 18:45:34 -0800 (PST)
          (envelope-from avalon@coombs.anu.edu.au)
Message-Id: <199712170245.SAA27242@hub.freebsd.org>
Received: by cheops.anu.edu.au
	(1.37.109.16/16.2) id AA262326616; Wed, 17 Dec 1997 13:43:36 +1100
From: Darren Reed <avalon@coombs.anu.edu.au>
Subject: Re: Is this something to worry about?
To: dhawk@river.org (David Hawkins)
Date: Wed, 17 Dec 1997 13:43:36 +1100 (EDT)
Cc: freebsd-security@FreeBSD.ORG
In-Reply-To: <199712170051.QAA14100@ohio.river.org> from "David Hawkins" at Dec 16, 97 04:51:08 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: owner-freebsd-security@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

In some mail from David Hawkins, sie said:
> 
> Background: today I did a make and install in /usr/ports/x11/XFree86
> and XFree86-contrib and I thought I hadn't touched /usr/bin
> but noticed this later in the day:
> 
> -r-xr-xr-x  1 bin   bin        123 Dec  6 07:02 linux
> -r-xr-xr-x  1 bin   bin        122 Dec  6 07:02 qcam
> -r-xr-xr-x  1 bin   bin      16384 Dec 16 05:00 tail
> -r-xr-xr-x  1 bin   bin     126976 Dec 16 10:55 awk
> -r-xr-xr-x  1 bin   bin      12288 Dec 16 11:35 du
> 
> That the last three files there were modified today. I'm not aware of
> anything on the system that would have modified 'tail' at 5am.

You haven't used something like "file(1)" on them or some other program
that changes the inode using utimes, have you ?