SELinux last straw

Matthew Miller mattdm at mattdm.org
Thu Oct 18 16:40:31 UTC 2007


On Wed, Oct 17, 2007 at 04:27:29PM -0700, Gordon Messmer wrote:
> >subdirectory of some other machine, then running rsync -avn against the 
> >live one to see what has changed.
> That might not be good enough.  'rsync -a' will skip more thorough 
> checks if two files size and mod times match.  An attacker could fairly 
> easily produce a binary of the same size, and fix the mod time after 
> installation.

Adding -c will make it do a full checksum of each file. This will be very
slow but hard to trick.

-- 
Matthew Miller           mattdm at mattdm.org          <http://mattdm.org/>
Boston University Linux      ------>              <http://linux.bu.edu/>




More information about the users mailing list