Mysterious file corruption after cron.daily execution
John Stroud
bear at amberorder.com
Tue Jan 6 00:13:45 UTC 2004
Casper Pedersen wrote:
> I had the same problem. The issue is prelink
(/etc/cron.daily/prelink),
> and the only way I found to solve the issue is to move prelink out of
> the cron.daily directory.
>
> After that remove /usr/lib/AntiVir/antivir and reinstall the
> antivirus toolkit.
>
> Regards/Casper
>
> On Tue, 2004-01-06 at 00:03, John Stroud wrote:
>> I need a little help trying to solve a fedora-related
>> mystery... I'm hoping someone has seen this or has some
>> magical insight...
>>
>> The executable file /usr/bin/AntiVir/antivir
>> (http://www.hbedv.com/) is getting modified sometime during
>> or after the default cron.daily run. After the cron job the
>> file is 1160 bytes longer than it was prior. (See [1])
>>
<snip>
Casper, et al,
Thanks again for the pointing out of the culprit.
FYI, here's my interim work around until blacklisting is included in
prelink:
mv /usr/lib/Antivir /usr/local/lib/
ln -s /usr/local/lib/AntiVir /usr/lib/AntiVir
Since the -l flag is used throughout the /etc/prelink.conf setup, it
seems the directory symlinks in /usr/lib are not walked, and the antivir
executable is not modified with this layout.
My only test thus far was to run /etc/cron.daily/prelink manually and
watch the antivir binary and its operation, which all appeared normal
prior and subsequent to running prelink.
--
John Stroud Senior System Admin
Piedmont, CA 510-501-9173 (Cell)
More information about the fedora-list
mailing list