up vote 0 down vote favorite
share [g+] share [fb]

G'day,

while investigating unexpected behaviour on one particular RHEL 5 instance I came across the irritating fact that the file size of /usr/lib/libz.so.1.2.3 differs on some RHEL 5 instances, although the RPM package is reported to be identicl, with identical build dates. My own RHEL with package zlib-1.2.3-3.i386.rpm as well as one installation at a customer site has a libz.so.1.2.3 of 75284 bytes:

-rwxr-xr-x 1 root root 75284 19. Jul 2006  /usr/lib/libz.so.1.2.3

On another RHEL 5 instance with the identical package version the same file has 73836 bytes:

-rwxr-xr-x 1 root root 73836 Jul 19  2006 /usr/lib/libz.so.1.2.3

When extracting the rpm file using

rpm2cpio zlib-1.2.3-3.i386.rpm | cpio -idv

the shared library is created with a size of 73836 bytes, so I assume, this size is correct. However, the same file on most other installations have a size of 75284 bytes.

Does anybody have a clue why this is the case?

Regards, Stefan

link|improve this question
feedback

2 Answers

up vote 2 down vote accepted

Probably prelink.

link|improve this answer
What does that mean? – struppi Nov 29 '10 at 15:04
Well, according to the article, prelink modifies ELF binaries. If information is added to the binary, its size increases. – Ignacio Vazquez-Abrams Nov 29 '10 at 15:09
Well, thanks a lot for your input (I haven't noticed there was a hyperlink, sorry). However, I have another question: if I understand the article correctly, prelinking affects the executable, not the shared libraries. Or are they also modified? – struppi Nov 29 '10 at 15:44
From prelink(8): "prelink is a program that modifies ELF shared libraries and ELF dynamically linked binaries..." – Ignacio Vazquez-Abrams Nov 29 '10 at 16:31
Thanks a lot for this answer. It appears that someone (or somewhat) has modified /etc/sysconfig/prelink to disable prelink on our customer's box. Now I have to find out who and why! Thanks! – struppi Dec 1 '10 at 15:30
feedback
up vote 1 down vote

You can use the following command to determine if a file provided by an RPM has been modified on the file system:

rpm -qVv zlib.i386

It will produce results similar to this:

[msavona@admina03:~]$ rpm -qVv zlib.i386
........    /usr/lib/libz.so.1
........    /usr/lib/libz.so.1.2.3
........    /usr/share/doc/zlib-1.2.3
........  d /usr/share/doc/zlib-1.2.3/README

Where the periods represent: file size, mode, md5 checksum, symlink, device, user, group, modified time

If you see something that looks like this:

S.5.....    /usr/lib/libz.so.1.2.3

Then the filesize and MD5 checksum differs between the file provided by the RPM and the file as it resides on the file system.

If the file on the file system does indeed differ, something external (outside of RPMs management) altered this file.

For what it's worth, on a RHEL5 system (zlib-1.2.3-3.i386 package), here's what my file looks like (from rpm -q --dump zlib.i386):

/usr/lib/libz.so.1.2.3 73836 1153298282 02864132ee9f24adcf3502be355c633b 0100755 root root 0 0 0 X
link|improve this answer
prelink also modifies the rpmdb, so this check is less than reliable in that sense. – Ignacio Vazquez-Abrams Nov 29 '10 at 16:36
I am unable to comment or up-vote your answer Ignacio because I don't have enough reputation, but you are indeed correct. The following proves it: prelink -y /usr/lib/libz.so.1.2.3 >/tmp/libz.so.1.2.3.tmp && md5sum /tmp/libz.so.1.2.3.tmp && rm /tmp/libz.so.1.2.3.tmp . The resultant md5sum is 02864132ee9f24adcf3502be355c633b which is the original MD5 sum contained within the RPM. As such, Ignacio's answer is the correct one. – loopforever Nov 29 '10 at 17:12
Even better than my last comment, use this single command: prelink --md5 -y /usr/lib/libz.so.1.2.3 – loopforever Nov 29 '10 at 17:22
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.