From owner-freebsd-security Tue Dec 16 18:28:38 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.7/8.8.7) id SAA26260 for security-outgoing; Tue, 16 Dec 1997 18:28:38 -0800 (PST) (envelope-from owner-freebsd-security) Received: from word.smith.net.au (vh1.gsoft.com.au [203.38.152.122]) by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id SAA26253 for ; Tue, 16 Dec 1997 18:28:31 -0800 (PST) (envelope-from mike@word.smith.net.au) Received: from word (localhost [127.0.0.1]) by word.smith.net.au (8.8.8/8.8.5) with ESMTP id MAA01090; Wed, 17 Dec 1997 12:52:43 +1030 (CST) Message-Id: <199712170222.MAA01090@word.smith.net.au> X-Mailer: exmh version 2.0zeta 7/24/97 To: David Hawkins cc: freebsd-security@freebsd.org Subject: Re: Is this something to worry about? In-reply-to: Your message of "Tue, 16 Dec 1997 16:51:08 -0800." <199712170051.QAA14100@ohio.river.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Wed, 17 Dec 1997 12:52:42 +1030 From: Mike Smith Sender: owner-freebsd-security@freebsd.org X-Loop: FreeBSD.org Precedence: bulk > Background: today I did a make and install in /usr/ports/x11/XFree86 > and XFree86-contrib and I thought I hadn't touched /usr/bin > but noticed this later in the day: > > -r-xr-xr-x 1 bin bin 123 Dec 6 07:02 linux > -r-xr-xr-x 1 bin bin 122 Dec 6 07:02 qcam > -r-xr-xr-x 1 bin bin 16384 Dec 16 05:00 tail > -r-xr-xr-x 1 bin bin 126976 Dec 16 10:55 awk > -r-xr-xr-x 1 bin bin 12288 Dec 16 11:35 du > > That the last three files there were modified today. I'm not aware of > anything on the system that would have modified 'tail' at 5am. This is a "feature" of the system; occasionally executables appear to be written to while they're running. Nobody has been able to work out why; the write doesn't appear to change any of the actual contents of the file. mike