[Aide] Aide (over)reacts when Prelink has run
Rick van Rein
rick at openfortress.nl
Fri Apr 27 18:13:39 EEST 2007
Hello Aide users,
I am running into loads of reported changes everytime prelink has run.
This is a problem in that it makes it easy to overlook actual attacks.
I find it a good thing if Aide notices a dependency (a library) has changed
underneath a dependent (an executable), but not if this concerns only the
loading location of the dependency (which AFAIK is what prelink sets).
Is there a good way to work around these problems?
I am using Aide 0.12 and prelink 0.3.9 as supplied with RHEL5.
Rick van Rein,
More information about the Aide