Re: beat down - need help w/ prelinking errors after reinstall from hack

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Oh that is great - I thought i might be hacked again.  I didn't
understand what prelinking is or that it is run by cron.

thx

On 2/18/07, Steve Siegfried <sos@xxxxxxxx> wrote:
Bazooka Joe wrote:
>
> Yes I had already updated it and the errors showed up several hrs later.
>
>
> On 2/17/07, Steve Siegfried <sos@xxxxxxxx> wrote:
> > Bazooka Joe wrote:
> > >
> > > Got rootkited on friday. spent today building a new box and moving
> > > data.  now my new box is giving errors. I had been running rkhunter
> > > periodically as I reinstalled and then one time it came up w/ this
> > > prelink error so I ran rpm -qVa and you can see below.   btw I am
> > > using fc4
> > >
> > > please don't tell me I have to start over.
> > >
> > > thx
> > > chris
> > >
> > > [root@localhost]# rpm -qVa
> > <rpm -qVa output deleted>
> >
> > Had you done any updates yet or was this FC4 "out of the box"?
> >
> > -S
> >

Here's the chain of events that ought to cause that:

        1- you load FC4,
        2- prelink runs via cron,
        3- you run yumex or some such causing a library to be updated,
        4- you run "rpm -qVa" which reports that "one of the file's
           dependencies" (i.e.: that library) "has changed since
           prelinking".

Not sure what you do at this point, except to let prelink run again
via it's cron script.  Once that happens, the dependency messages from
"rpm -qVa" ought to go away.

Personally, the more I see of prelink, the more I want to turn it off.

-S



[Index of Archives]     [Current Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]     [Fedora Docs]

  Powered by Linux