From owner-freebsd-current Thu Aug 2 14:38: 5 2001 Delivered-To: freebsd-current@freebsd.org Received: from london.physics.purdue.edu (london.physics.purdue.edu [128.210.67.35]) by hub.freebsd.org (Postfix) with ESMTP id 9841937B403 for ; Thu, 2 Aug 2001 14:38:00 -0700 (PDT) (envelope-from will@physics.purdue.edu) Received: from bohr.physics.purdue.edu (bohr.physics.purdue.edu [128.210.67.12]) by london.physics.purdue.edu (8.8.8/8.8.8) with ESMTP id QAA04070; Thu, 2 Aug 2001 16:38:00 -0500 (EST) Received: by bohr.physics.purdue.edu (Postfix, from userid 12409) id C2E5F5BB5; Thu, 2 Aug 2001 16:39:42 -0500 (EST) Date: Thu, 2 Aug 2001 16:39:42 -0500 From: Will Andrews To: Christian Weisgerber Cc: freebsd-current@FreeBSD.ORG Subject: Re: What's touching my executables? Message-ID: <20010802163942.J451@bohr.physics.purdue.edu> Reply-To: Will Andrews Mail-Followup-To: Christian Weisgerber , freebsd-current@FreeBSD.ORG References: <9kc65b$47n$1@kemoauc.mips.inka.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.3.17i In-Reply-To: <9kc65b$47n$1@kemoauc.mips.inka.de>; from naddy@mips.inka.de on Thu, Aug 02, 2001 at 06:28:59PM +0000 X-Operating-System: FreeBSD 4.3-STABLE i386 Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Thu, Aug 02, 2001 at 06:28:59PM +0000, Christian Weisgerber (naddy@mips.inka.de) wrote: > An increasing number of executables on that box are sporting ever > newer mtimes. This appears to have been going on ever since the > Jul 25 update. There is no clear pattern which executables are > touched. md5 comparisons with previous backup levels (using a Jul 13 > copy of md5) suggest that the executables have not been changed. > > For various reasons I consider it unlikely that I'm dealing with a > security issue here, although I'm looking into that as well. > > Can anybody think of a technical explanation? Probably the recent change (IIRC) that someone turned running an executable into a mtime change. -- wca To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message