RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 751464 - aide and prelink false alarms
Summary: aide and prelink false alarms
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: aide
Version: 6.4
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Daniel Kopeček
QA Contact: Karel Srot
URL:
Whiteboard:
: 950625 (view as bug list)
Depends On:
Blocks: 782183 835616 1002711 1172231 1271982
TreeView+ depends on / blocked
 
Reported: 2011-11-04 19:49 UTC by Jason Priebe
Modified: 2019-09-12 07:40 UTC (History)
18 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1267143 (view as bug list)
Environment:
Last Closed: 2016-01-19 15:50:10 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
A partial fix for the prelink verify/directory modification problem (1.67 KB, patch)
2012-12-07 21:33 UTC, Mark Carson 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 950645 0 unspecified CLOSED aide doesn't handle system update before initialization and after running prelink cronjob 2021-02-22 00:41:40 UTC
Red Hat Knowledge Base (Solution) 69040 0 None None None Never

Internal Links: 950645

Description Jason Priebe 2011-11-04 19:49:06 UTC 
Description of problem:

When aide calls "prelink --verify" on a binary, the parent directory's mtime is changed (because prelink --verify writes a temporary file into the parent directory, and then deletes it)

Version-Release number of selected component (if applicable):

0.14-3  (note, I actually used the SRPM to back-port this version of aide to RHEL 5)

How reproducible:

Always

Steps to Reproduce:
1. build the aide database
2. run the prelinker
3. run an aide check -- you'll see various directories reported as changed
  
Actual results:

many directories containing binaries will be reported as changed

Expected results:

Nothing should be reported as changed

Additional info:
Comment 2 RHEL Program Management 2011-11-04 20:08:55 UTC 
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unfortunately unable to
address this request at this time. Red Hat invites you to
ask your support representative to propose this request, if
appropriate and relevant, in the next release of Red Hat
Enterprise Linux. If you would like it considered as an
exception in the current release, please ask your support
representative.
Comment 3 Suzanne Logcher 2012-03-07 21:27:43 UTC 
This request was evaluated by Red Hat Product Management for inclusion in the
current release of Red Hat Enterprise Linux. Because the affected component is
not scheduled to be updated in the current release, Red Hat is unfortunately
unable to address this request at this time.  It has been proposed for the next
release. If you would like it considered as an exception in the current
release, please ask your support representative.
Comment 5 RHEL Program Management 2012-07-10 06:53:39 UTC 
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 6 RHEL Program Management 2012-07-10 23:03:50 UTC 
This request was erroneously removed from consideration in Red Hat Enterprise Linux 6.4, which is currently under development.  This request will be evaluated for inclusion in Red Hat Enterprise Linux 6.4.
Comment 8 Daniel Kopeček 2012-07-31 09:09:49 UTC 
Changing component to prelink as this looks like a bug in prelink.
Comment 11 RHEL Program Management 2012-09-07 05:21:23 UTC 
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.
Comment 13 Mark Carson 2012-12-07 21:33:32 UTC 
Created attachment 659597 [details]
A partial fix for the prelink verify/directory modification problem

I made a trivial patch for the issue of prelink --verify modifying directories. It simply allows specifying the base pathnames (using the -o flag) for the temporary files created during the verify process.

It's only a partial fix, though, as it doesn't work properly for dependencies specified with relative paths. For example:

# ldd appletviewer 
        linux-vdso.so.1 =>  (0x00007fff2d88d000)
        libz.so.1 => /lib64/libz.so.1 (0x0000003531000000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000003530c00000)
        libX11.so.6 => /usr/lib64/libX11.so.6 (0x0000003532800000)
        libjli.so => /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/bin/./../jre/lib/amd64/jli/libjli.so (0x0000003530400000)
        libdl.so.2 => /lib64/libdl.so.2 (0x0000003530800000)
        libc.so.6 => /lib64/libc.so.6 (0x0000003530000000)
        /lib64/ld-linux-x86-64.so.2 (0x000000352fc00000)
        libxcb.so.1 => /usr/lib64/libxcb.so.1 (0x0000003533000000)
        libXau.so.6 => /usr/lib64/libXau.so.6 (0x0000003532c00000)
# prelink -o /tmp/verify --verify appletviewer 
prelink: /tmp/verify.#prelink#.yh3rOP: Recorded 9 dependencies, now seeing -1

This is because libjli.so is specified with a relative path, so depends on the executable being in /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/bin (for the case here).
Comment 17 Jakub Jelinek 2013-08-22 13:10:06 UTC 
That sounds like a flaw in aide, trying to verify something that really doesn't make sense to verify.  prelink has to put the temporary files into the same directory as the libraries resp. programs for --verify, otherwise the dynamic linker could not find the right dependencies which can be relative to that (DT_RPATH, DT_RUNPATH etc.).  If you don't want to modify the directory, you can only use prelink --undo -o - or similar, which isn't as strong verification as --verify, but doesn't need to write into the same directory.
Comment 19 RHEL Program Management 2013-10-14 00:55:35 UTC 
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.
Comment 25 Daniel Kopeček 2015-10-13 07:30:31 UTC 
*** Bug 950625 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.