Bug 1267143

Summary: aide and prelink false alarms
Product: Red Hat Enterprise Linux 7 Reporter: Karel Srot <ksrot>
Component: aideAssignee: Daniel Kopeček <dkopecek>
Status: CLOSED WONTFIX QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.1   
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 751464 Environment:
Last Closed: 2016-05-03 11:42:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Karel Srot 2015-09-29 06:38:06 UTC
present also on RHEL-7

+++ This bug was initially created as a clone of Bug #751464 +++

Description of problem:

When aide calls "prelink --verify" on a binary, the parent directory's mtime is changed (because prelink --verify writes a temporary file into the parent directory, and then deletes it)

Version-Release number of selected component (if applicable):

0.14-3  (note, I actually used the SRPM to back-port this version of aide to RHEL 5)

How reproducible:

Always

Steps to Reproduce:
1. build the aide database
2. run the prelinker
3. run an aide check -- you'll see various directories reported as changed
  
Actual results:

many directories containing binaries will be reported as changed

Expected results:

Nothing should be reported as changed

Additional info:

--- Additional comment from Jijesh Kalliyat on 2012-07-02 05:26:37 EDT ---

As per my understanding, the root cause of this issue is, When aide calls "prelink --verify" on a binary, the parent directory's mtime is changed because prelink --verify writes a temporary file into the parent directory, and then deletes it. Do you think the bug should be against prelink if prelink is creating tmp files outside of /tmp or /var/tmp ? 

--- Additional comment from Kevin Clevenger on 2012-08-23 16:36:27 EDT ---

After some experimentation it seems that even if the aide database is created after prelink is run aide --check will always be dirty.

/etc/sysconfig/prelink
  PRELINKING=no
prelink -ua
aide --init
cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
aide --check
* aide check is clean
-rwxr-xr-x. 1 root root 903240 Aug 23 09:40 /bin/bash

/etc/sysconfig/prelink
  PRELINKING=no
prelink -va
aide --init
cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
aide --check
* aide check is dirty
-rwxr-xr-x. 1 root root 938736 Aug 23 09:40 /bin/bash

...
Directory: /bin
  Mtime    : 2012-08-23 21:44:39              , 2012-08-23 21:45:40
  Ctime    : 2012-08-23 21:44:39              , 2012-08-23 21:45:40

Directory: /usr/lib64
  Mtime    : 2012-08-23 21:44:38              , 2012-08-23 21:45:19
  Ctime    : 2012-08-23 21:44:38              , 2012-08-23 21:45:19