Thanks. Yes, prelink seems to have actually been changing the files.
After running prelink to revert its actions the files and their checksums
returned to normal. Enabling/Disabling prelink can be accomplished by
setting, respectively, yes or no for PRELINKING in /etc/sysconfig/prelink
and executing the script /etc/cron.daily/prelink.
On Sat, 10 Mar 2007, Dennis Gilmore wrote:
Once upon a time Saturday 10 March 2007, Wiktor Rzeczkowski wrote:
> I did some testing of RHEL v.4 U4 AS, FC3, FC5 and FC6 and seem to have
> been finding that, soon after a fresh installation of the OS on a
> non-networked machine, many files were automatically changing. I also seem
> to have been finding that some time after package update, the files were
> automatically changing again.
> /bin/ls is one of the files that were changing. The file is part of
> coreutils package. The following are MD5 checksums for /bin/ls on the
> specified RHEL and FC systems immediately after installation of the
> specified coreutils package (current version). The checksums are computed
> by 'md5sum /bin/ls' and the versions of OS and of coreutils are displayed
> by 'cat /etc/redhat-release' and 'rpm -q coreutils' (no quotes),
what you are seeing is prelink in action. from prelink's man page
prelink is a program which modifies ELF shared libraries and ELF dynamically
linked binaries, so that the time which dynamic linker needs for their
relocation at startup significantly decreases and also due to fewer
relocations the run-time memory consumption decreases too (especially number
of unshareable pages). Such prelinking information is only used if all
its dependant libraries have not changed since prelinking, otherwise programs
are relocated normally.
you are free to disable prelink if you want.