From owner-freebsd-current  Fri Feb 14 19:15:14 1997
Return-Path: <owner-current>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id TAA24036
          for current-outgoing; Fri, 14 Feb 1997 19:15:14 -0800 (PST)
Received: from labs.usn.blaze.net.au (labs.usn.blaze.net.au [203.17.53.30])
          by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id TAA23868
          for <freebsd-current@FreeBSD.ORG>; Fri, 14 Feb 1997 19:12:07 -0800 (PST)
Received: (from davidn@localhost)
	by labs.usn.blaze.net.au (8.8.5/8.8.5) id OAA01066;
	Sat, 15 Feb 1997 14:11:09 +1100 (EST)
Message-ID: <19970215141106.27611@usn.blaze.net.au>
Date: Sat, 15 Feb 1997 14:11:06 +1100
From: David Nugent <davidn@labs.usn.blaze.net.au>
To: John Polstra <jdp@polstra.com>
Cc: freebsd-current@FreeBSD.ORG
Subject: Re: [root@server.blaze.net.au: server security check output]
References: <19970215033810.19932@usn.blaze.net.au> <5e2ag5$h65@austin.polstra.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.61
In-Reply-To: <5e2ag5$h65@austin.polstra.com>; from John Polstra on Feb 02, 1997 at 10:21:57AM
Sender: owner-current@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk

On Feb 02, 1997 at 10:21:57AM, John Polstra wrote:
> > This is the second time I've seen this since I last built
> > world - something has "touched" sendmail. It doesn't appear to
> > have been hacked, and I even checked the md5 against what it was
> > originally when I last installed sendmail and it hasn't changed.
> > But suddenly the file date has been modified, and only a couple
> > of hours ago.
> 
> Yes, I have seen this sort of thing in all versions of FreeBSD
> since 2.0.5, the first one I used.  It's not specific to sendmail,
> although I've only noticed it in setuid programs.  (That may be
> just because those are the ones that show up in the security logs.)

True enough. However, I checked the rest of the tree since I
sent that mail, and it seems to be sendmail only at this stage.


> I have seen it happen to my X server a couple of times.  It is some
> kind of anomaly involving the VM system, I would guess.

Out of curiosity, is this linked to gdb's annoying habit of thinking
that an executable has been changed when you run it a second time from
the gdb prompt?


> like it either, but nobody has ever been able to explain it, as
> far as I know.  On my system, I see it maybe once every 4-6 months.
> I don't think anybody knows of a way to make it happen deliberately.

Don't you just hate bugs like that? :-/


Thanks for the response.

David Nugent - Unique Computing Pty Ltd - Melbourne, Australia
Voice +61-3-9791-9547  Data/BBS +61-3-9792-3507  3:632/348@fidonet
davidn@freebsd.org davidn@blaze.net.au http://www.blaze.net.au/~davidn/