mtime of untouched files changed?

[Reindl Harald]

Am 19.05.2015 um 17:25 schrieb Eric Sandeen:
> On 5/19/15 4:14 AM, Reindl Harald wrote:
>> i switched from "noatime,nodiratime" to
>> "relatime,nodiratime,lazytime" which seems to lead in unexpected
>> mtime changes for a lot of files leading in rkhunter alerts and
>> likely rsync problems
>
> The cargo-cult tuning, it burns!  ;)
>
> noatime implies nodiratime, no need to specify both:

and "relatime" implies it too?

> touch_atime()
> {
> ...
>          if (mnt->mnt_flags & MNT_NOATIME)
>                  return;
>          if ((mnt->mnt_flags & MNT_NODIRATIME) && S_ISDIR(inode->i_mode))
>                  return;

different story

> and relatime is default, so no need to re-specify:
>
>          /* Default to relatime unless overriden */
>          if (!(flags & MS_NOATIME))
>                  mnt_flags |= MNT_RELATIME;
>
> Anyway ... you didn't say what kernel you were running under, or what
> filesystem.

surely you just stripped that part from your reply

May 15 13:35:51 Installed: kernel-core-4.0.3-201.fc21.x86_64
May 15 13:35:54 Installed: kernel-modules-4.0.3-201.fc21.x86_64
May 15 13:35:55 Updated: kernel-headers-4.0.3-201.fc21.x86_64

> If it's ext4, there have been some flaws there; recently:

yes, "lazytime" implies ext4

>> commit 8f4d855839179f410fa910a26eb81d646d628f26
>> Author: Theodore Ts'o <tytso at mit.edu>
>> Date:   Thu May 14 18:19:01 2015 -0400
>>
>>      ext4: fix lazytime optimization
>>
>>      We had a fencepost error in the lazytime optimization which means that
>>      timestamp would get written to the wrong inode.
>>
>>      Cc: stable at vger.kernel.org
>>      Signed-off-by: Theodore Ts'o <tytso at mit.edu>
>
> which looks like it's probably the culprit.  This was broken since:
>
>> commit a26f49926da938f47561f386be56a83dd37a496d
>> Author: Theodore Ts'o <tytso at mit.edu>
>> Date:   Mon Feb 2 00:37:02 2015 -0500
>>
>>      ext4: add optimization for the lazytime mount option

wow - and nobody noticed all the months that mtimes are randomly 
changing all over the system while it takes exactly one day to get 
rkhunter mails and rsync listing a ton of untouched files