|
I upgraded tripwire from
tripwire-2.3.1-20.fdr.1.1.i386.rpm to tripwire-2.3.1-21.i386.rpm, the initial
check caught the changes (which were then accepted), but then my nightly check
caught again changes in the tripwire binaries. Here is the jist of them
(obviously the checksums and inodes changed as well):
Surprisingly, rpm -V tripwire only reports
(expected) changes to policy and configuration files, and is happy about the
binaries! Files extracted manually from the original rpm show the same
characteristics as the original install (the "from" values in the list
above).
I am suspecting prelink is the culprit (found
entries for all of the above in /var/log/prelink.log), but that still does not
explain why rpm -V is absolutely silent about the changes?
--Marcin
|
