Does the on-disk image of an executable ever change?

[Kevin D. Clark]

Michael ODonnell writes:

> I'm looking at some supposedly identical CentOS5.3 systems that are
> behaving strangely and while grasping at straws I generated lists of
> the MD5 sums of all the files on the root partitions and I'm seeing
> differences in the on-disk images of things like /sbin/mount and
> /lib64/libblkid.so.1.0 that AFAIK are supposed to be entirely static.

For *two* of the systems in question, where you are seeing a
difference, can you send us the output of:

  sha1sum /path/to/the/file/in/question

  rpm -qf /path/to/the/file/in/question

  rpm --verify -f /path/to/the/file/in/question


Obviously, I'm trying to figure out where you stand before we try
anything more complicated.

I can't think of a reason why these files would change in normal use.
Is there any chance that these machines could have been broken into?

Regards,

--kevin
-- 
GnuPG ID: B280F24E                God, I loved that Pontiac.
alumni.unh.edu!kdc                -- Tom Waits
http://kdc-blog.blogspot.com/