[Aide] Aide (over)reacts when Prelink has run

Rick van Rein rick at openfortress.nl
Fri Apr 27 18:13:39 EEST 2007


Hello Aide users,

I am running into loads of reported changes everytime prelink has run.
This is a problem in that it makes it easy to overlook actual attacks.

I find it a good thing if Aide notices a dependency (a library) has changed
underneath a dependent (an executable), but not if this concerns only the
loading location of the dependency (which AFAIK is what prelink sets).

Is there a good way to work around these problems?

I am using Aide 0.12 and prelink 0.3.9 as supplied with RHEL5.

Thank you,

Rick van Rein,
OpenFortress.


More information about the Aide mailing list