Re: [Rkhunter-users] rkhunter changes ctime & mtime during "properties" checking

[John H. <joh...@pl...>]

On Tue, 2011-03-01 at 12:06 +1100, Michael Fomichyov wrote:
> When I run "rkhunter -c --enable properties" it changes ctime & mtime of 
> /bin, /sbin, /usr/bin, /usr/sbin, /usr/lib.
> 
> Is it really needed to change ctime & mtime?
> 
> Is there way to avoid rkhunter to change ctime & mtime?
> 
Hello,

If your system uses prelinking then the times will change - the
prelinking causes that. No way around that that I know of.

Ironically I would expect the atime to change, but that is the one that
doesn't change (it is handled by the prelink command I think). Yet on a
non-prelinked system the mtime and ctime are unchanged but the atime is.



John.


-- 
John Horne, University of Plymouth, UK
Tel: +44 (0)1752 587287    Fax: +44 (0)1752 587001