<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1498" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>I am running FC3 with tripwire-2.3.1-20.fdr.1.1
(RPM), and all of a sudden, after months of successful "quite" or almost quiet
bahvior, my nightly check reports over 6500 changes. This is very
unusual for an "overnight" situation, and so I am trying to figure out what
caused it. </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I did an up2date on glibc (which triggered other
packages, such as gcc, cpp, and libgcc), required to compile FrontPage
extensions, and I also played with SE_Linux (set SELINUX from enforcing to
permissive, with a reboot in between), but I see files from all kinds of
packages as changed. Most of the ones that should not change have a
different inode number, different CRC32 and different MD5; sizes, times, etc,
are the same. </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Any ideas as to what may have triggered such an
avalanche of changes? How possibly can the same file have a different
CRC? Does SE_Linux do something to actual files on the disk? Maybe
to the inode table? I thought it maintained a database for the kernel to
consult, and the actual files were independent. </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Thanks in advance. </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>--Marcin</FONT></DIV></BODY></HTML>