Date: Thu, 2 Aug 2001 15:38:08 -0700 From: David Greenman <dg@root.com> To: Will Andrews <will@physics.purdue.edu> Cc: Christian Weisgerber <naddy@mips.inka.de>, freebsd-current@FreeBSD.ORG Subject: Re: What's touching my executables? Message-ID: <20010802153808.A62297@nexus.root.com> In-Reply-To: <20010802163942.J451@bohr.physics.purdue.edu>; from will@physics.purdue.edu on Thu, Aug 02, 2001 at 04:39:42PM -0500 References: <9kc65b$47n$1@kemoauc.mips.inka.de> <20010802163942.J451@bohr.physics.purdue.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
>On Thu, Aug 02, 2001 at 06:28:59PM +0000, Christian Weisgerber (naddy@mips.inka.de) wrote: >> An increasing number of executables on that box are sporting ever >> newer mtimes. This appears to have been going on ever since the >> Jul 25 update. There is no clear pattern which executables are >> touched. md5 comparisons with previous backup levels (using a Jul 13 >> copy of md5) suggest that the executables have not been changed. >> >> For various reasons I consider it unlikely that I'm dealing with a >> security issue here, although I'm looking into that as well. >> >> Can anybody think of a technical explanation? > >Probably the recent change (IIRC) that someone turned running an >executable into a mtime change. There was no such change. I proposed a change that would update the atime, but that was not committed because it has some bad side effects. -DG David Greenman Co-founder, The FreeBSD Project - http://www.freebsd.org President, TeraSolutions, Inc. - http://www.terasolutions.com Pave the road of life with opportunities. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010802153808.A62297>