<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1498" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>I upgraded tripwire from
tripwire-2.3.1-20.fdr.1.1.i386.rpm to tripwire-2.3.1-21.i386.rpm, the initial
check caught the changes (which were then accepted), but then my nightly check
caught again changes in the tripwire binaries. Here is the jist of them
(obviously the checksums and inodes changed as well):</FONT></DIV>
<UL>
<LI><FONT face=Arial size=2>/usr/sbin/siggen grew from 1240308 to
1246768</FONT></LI>
<LI><FONT face=Arial size=2>/usr/sbin/tripwire grew from 1779188 to
1785884</FONT></LI>
<LI><FONT face=Arial size=2>/usr/sbin/twadmin grew from 1609652 to
1616280</FONT></LI>
<LI><FONT face=Arial size=2>/usr/sbin/twprint grew from 1369780 to
1376428</FONT></LI></UL>
<DIV><FONT face=Arial size=2>Surprisingly, rpm -V tripwire only reports
(expected) changes to policy and configuration files, and is happy about the
binaries! Files extracted manually from the original rpm show the same
characteristics as the original install (the "from" values in the list
above). </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I am suspecting prelink is the culprit (found
entries for all of the above in /var/log/prelink.log), but that still does not
explain why rpm -V is absolutely silent about the changes? </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>--Marcin</FONT></DIV></BODY></HTML>