Bug 1267143 - aide and prelink false alarms
aide and prelink false alarms
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: aide (Show other bugs)
7.1
All Linux
medium Severity medium
: rc
: ---
Assigned To: Daniel Kopeček
BaseOS QE Security Team
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-09-29 02:38 EDT by Karel Srot
Modified: 2016-05-03 07:42 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 751464
Environment:
Last Closed: 2016-05-03 07:42:43 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Karel Srot 2015-09-29 02:38:06 EDT
present also on RHEL-7

+++ This bug was initially created as a clone of Bug #751464 +++

Description of problem:

When aide calls "prelink --verify" on a binary, the parent directory's mtime is changed (because prelink --verify writes a temporary file into the parent directory, and then deletes it)

Version-Release number of selected component (if applicable):

0.14-3  (note, I actually used the SRPM to back-port this version of aide to RHEL 5)

How reproducible:

Always

Steps to Reproduce:
1. build the aide database
2. run the prelinker
3. run an aide check -- you'll see various directories reported as changed
  
Actual results:

many directories containing binaries will be reported as changed

Expected results:

Nothing should be reported as changed

Additional info:

--- Additional comment from Jijesh Kalliyat on 2012-07-02 05:26:37 EDT ---

As per my understanding, the root cause of this issue is, When aide calls "prelink --verify" on a binary, the parent directory's mtime is changed because prelink --verify writes a temporary file into the parent directory, and then deletes it. Do you think the bug should be against prelink if prelink is creating tmp files outside of /tmp or /var/tmp ? 

--- Additional comment from Kevin Clevenger on 2012-08-23 16:36:27 EDT ---

After some experimentation it seems that even if the aide database is created after prelink is run aide --check will always be dirty.

/etc/sysconfig/prelink
  PRELINKING=no
prelink -ua
aide --init
cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
aide --check
* aide check is clean
-rwxr-xr-x. 1 root root 903240 Aug 23 09:40 /bin/bash

/etc/sysconfig/prelink
  PRELINKING=no
prelink -va
aide --init
cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
aide --check
* aide check is dirty
-rwxr-xr-x. 1 root root 938736 Aug 23 09:40 /bin/bash

...
Directory: /bin
  Mtime    : 2012-08-23 21:44:39              , 2012-08-23 21:45:40
  Ctime    : 2012-08-23 21:44:39              , 2012-08-23 21:45:40

Directory: /usr/lib64
  Mtime    : 2012-08-23 21:44:38              , 2012-08-23 21:45:19
  Ctime    : 2012-08-23 21:44:38              , 2012-08-23 21:45:19

Note You need to log in before you can comment on or make changes to this bug.