[Aide] Re: ... in databases has different attributes

[pbdlists at pinboard.com]

On Sat, Apr 30, 2005 at 08:54:27PM +0300, Virolainen Pablo wrote:
> On Thu, 28 Apr 2005 pbdlists at pinboard.com wrote:
> 
> > Is anybody else getting errors such as the ones below?
> > These are spurious and usually again the other way round the next day,
> > just as if aide sometimes mixed something up while reading the config
> > file. The files usually are not changed, touched or anything, neither
> > has the config file changes.
> >
> > File /home/usd0872/old/usd0872/tmp/treeps-1.2.2/scripts/SunOS/getGroupId in databases has different attributes, 24509,4029
> >    next day:
> > File /home/usd0872/old/usd0872/tmp/treeps-1.2.2/scripts/SunOS/getGroupId in databases has different attributes, 4029,24509
> 
> This seems like a bug.. The (changed) field tells what kind of data is
> stored about the file. If the field changes (with same configuration file.
> Remember that preprocessing can change the effective configuration file
> via changing hostname) databases may not be comparable.

I tried to find where this happens, but my ability to understand C is
no good. But what might help somebody else to find out what happens is a
trace. This was taken on a RHEL3 linux machine after a fresh compile of
the latest CVS checkout.

*** command run:
# strace -fFiv -o /tmp/aideinit.strace.out src/aide -c doc/aide.conf --init

*** output of the command:
File /tmp/aide/src/md.c was changed so that hash cannot be calculated for it
Attribute rdev has been changed
File /tmp/aide/src/snprintf.c was changed so that hash cannot be calculated for it
Attribute rdev has been changed

*** what I found in aide.db.new:
...
/tmp/aide/src/md.c 0 3105 16 6009 1 0 0 0
/tmp/aide/src/snprintf.c 0 3105 88 41929 1 0 0 0
...

*** relevant section of the strace output file:
...
24260 [002214ee] lstat64("/tmp/aide/src/list.c", {st_dev=makedev(8, 2), st_ino=209621, st_mode=S_IFREG|0644, st_nlink=1, st_uid=994, st_gid=994, st_blksize=4096, st_blocks=8, st_size=3889, st_atime=2005/06/10-15:58:29, st_mtime=2005/04/06-11:50:26, st_ctime=2005/06/10-15:12:00}) = 0
24260 [001e66bd] time(NULL)             = 1118411934
24260 [00221e04] open("/tmp/aide/src/list.c", O_RDONLY|O_LARGEFILE) = 5
24260 [002214ae] fstat64(5, {st_dev=makedev(8, 2), st_ino=209621, st_mode=S_IFREG|0644, st_nlink=1, st_uid=994, st_gid=994, st_blksize=4096, st_blocks=8, st_size=3889, st_atime=2005/06/10-15:58:29, st_mtime=2005/04/06-11:50:26, st_ctime=2005/06/10-15:12:00}) = 0
24260 [0022c45a] mmap2(NULL, 3889, PROT_READ, MAP_SHARED, 5, 0) = 0xb75f1000
24260 [0022c4a1] munmap(0xb75f1000, 3889) = 0
24260 [00221e97] close(5)               = 0
24260 [00221f8e] write(3, "/tmp/aide/src/list.c 0 31777 8 3"..., 121) = 121

24260 [002214ee] lstat64("/tmp/aide/src/md.c", {st_dev=makedev(8, 2), st_ino=209622, st_mode=S_IFREG|0755, st_nlink=1, st_uid=994, st_gid=994, st_blksize=4096, st_blocks=16, st_size=6009, st_atime=2005/06/10-15:37:41, st_mtime=2005/04/06-11:50:26, st_ctime=2005/06/10-15:12:00}) = 0
24260 [001e66bd] time(NULL)             = 1118411934
24260 [00221e04] open("/tmp/aide/src/md.c", O_RDONLY|O_LARGEFILE) = 5
24260 [002214ae] fstat64(5, {st_dev=makedev(8, 2), st_ino=209622, st_mode=S_IFREG|0755, st_nlink=1, st_uid=994, st_gid=994, st_blksize=4096, st_blocks=16, st_size=6009, st_atime=2005/06/10-15:37:41, st_mtime=2005/04/06-11:50:26, st_ctime=2005/06/10-15:12:00}) = 0
24260 [00221f8e] write(2, "File /tmp/aide/src/md.c was chan"..., 77) = 77
24260 [00221f8e] write(2, "Attribute rdev has been changed\n", 32) = 32
24260 [00221e97] close(5)               = 0
24260 [00221f8e] write(3, "/tmp/aide/src/md.c 0 3105 16 600"..., 42) = 42

24260 [002214ee] lstat64("/tmp/aide/src/snprintf.c", {st_dev=makedev(8, 2), st_ino=209623, st_mode=S_IFREG|0644, st_nlink=1, st_uid=994, st_gid=994, st_blksize=4096, st_blocks=88, st_size=41929, st_atime=2005/06/10-15:37:46, st_mtime=2004/10/28-14:58:08, st_ctime=2005/06/10-15:12:00}) = 0
24260 [001e66bd] time(NULL)             = 1118411934
24260 [00221e04] open("/tmp/aide/src/snprintf.c", O_RDONLY|O_LARGEFILE) = 5
24260 [002214ae] fstat64(5, {st_dev=makedev(8, 2), st_ino=209623, st_mode=S_IFREG|0644, st_nlink=1, st_uid=994, st_gid=994, st_blksize=4096, st_blocks=88, st_size=41929, st_atime=2005/06/10-15:37:46, st_mtime=2004/10/28-14:58:08, st_ctime=2005/06/10-15:12:00}) = 0
24260 [00221f8e] write(2, "File /tmp/aide/src/snprintf.c wa"..., 83) = 83
24260 [00221f8e] write(2, "Attribute rdev has been changed\n", 32) = 32
24260 [00221e97] close(5)               = 0
24260 [00221f8e] write(3, "/tmp/aide/src/snprintf.c 0 3105 "..., 49) = 49

24260 [002214ee] lstat64("/tmp/aide/src/symboltable.c", {st_dev=makedev(8, 2), st_ino=209624, st_mode=S_IFREG|0644, st_nlink=1, st_uid=994, st_gid=994, st_blksize=4096, st_blocks=8, st_size=1502, st_atime=2005/06/10-15:58:29, st_mtime=2005/04/06-11:50:26, st_ctime=2005/06/10-15:12:00}) = 0
24260 [001e66bd] time(NULL)             = 1118411934
24260 [00221e04] open("/tmp/aide/src/symboltable.c", O_RDONLY|O_LARGEFILE) = 5
24260 [002214ae] fstat64(5, {st_dev=makedev(8, 2), st_ino=209624, st_mode=S_IFREG|0644, st_nlink=1, st_uid=994, st_gid=994, st_blksize=4096, st_blocks=8, st_size=1502, st_atime=2005/06/10-15:58:29, st_mtime=2005/04/06-11:50:26, st_ctime=2005/06/10-15:12:00}) = 0
24260 [0022c45a] mmap2(NULL, 1502, PROT_READ, MAP_SHARED, 5, 0) = 0xb75f1000
24260 [0022c4a1] munmap(0xb75f1000, 1502) = 0
24260 [00221e97] close(5)               = 0
24260 [00221f8e] write(3, "/tmp/aide/src/symboltable.c 0 31"..., 128) = 128
...