From owner-freebsd-security Tue Dec 16 19:38:53 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.7/8.8.7) id TAA02251 for security-outgoing; Tue, 16 Dec 1997 19:38:53 -0800 (PST) (envelope-from owner-freebsd-security) Received: from dyson.iquest.net (dyson.iquest.net [198.70.144.127]) by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id TAA02246 for ; Tue, 16 Dec 1997 19:38:50 -0800 (PST) (envelope-from toor@dyson.iquest.net) Received: (from root@localhost) by dyson.iquest.net (8.8.8/8.8.8) id WAA01537; Tue, 16 Dec 1997 22:38:17 -0500 (EST) (envelope-from toor) From: "John S. Dyson" Message-Id: <199712170338.WAA01537@dyson.iquest.net> Subject: Re: Is this something to worry about? In-Reply-To: <199712170222.MAA01090@word.smith.net.au> from Mike Smith at "Dec 17, 97 12:52:42 pm" To: mike@smith.net.au (Mike Smith) Date: Tue, 16 Dec 1997 22:38:16 -0500 (EST) Cc: dhawk@river.org, freebsd-security@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL31 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk Mike Smith said: > > Background: today I did a make and install in /usr/ports/x11/XFree86 > > and XFree86-contrib and I thought I hadn't touched /usr/bin > > but noticed this later in the day: > > > > -r-xr-xr-x 1 bin bin 123 Dec 6 07:02 linux > > -r-xr-xr-x 1 bin bin 122 Dec 6 07:02 qcam > > -r-xr-xr-x 1 bin bin 16384 Dec 16 05:00 tail > > -r-xr-xr-x 1 bin bin 126976 Dec 16 10:55 awk > > -r-xr-xr-x 1 bin bin 12288 Dec 16 11:35 du > > > > That the last three files there were modified today. I'm not aware of > > anything on the system that would have modified 'tail' at 5am. > > This is a "feature" of the system; occasionally executables appear to > be written to while they're running. Nobody has been able to work out > why; the write doesn't appear to change any of the actual contents of > the file. > I think that it has been fixed in the 3.0 line of code. Let me know if there is ANY of this happening on -current! -- John | Never try to teach a pig to sing, dyson@freebsd.org | it just makes you look stupid, and jdyson@nc.com | it irritates the pig.