Does the on-disk image of an executable ever change?

Michael ODonnell michael.odonnell at comcast.net
Wed Nov 4 15:50:42 EST 2009


I'm looking at some supposedly identical CentOS5.3 systems that are
behaving strangely and while grasping at straws I generated lists of
the MD5 sums of all the files on the root partitions and I'm seeing
differences in the on-disk images of things like /sbin/mount and
/lib64/libblkid.so.1.0 that AFAIK are supposed to be entirely static.
WTF?  Is it ever the case that it's OK for the on-disk image of an
executable to change once it's been laid down?  I assume that (excluding
some possible weirdo corner cases like the old Emacs trick where the
binary would [yikes!] rewrite itself to save startup time on subsequent
invocations) the answer is an emphatic "No" but I could be wrong.

Also, since the systems in question don't have their RPMs handy I wonder
if there's some simple trick that would allow me to automagically verify
the various files against their corresponding RPMs in some repository
out on the Net without having to explicitly drag them all onboard and
execute an "rpm --verify" by hand...
 


More information about the gnhlug-discuss mailing list