Linux Security Cookbook [Electronic resources] نسخه متنی

Recipe 1.14 Checking Windows VFAT Filesystems

1.14.1 Problem

When checking the integrity of a

VFAT filesystem,
tripwire always complains that files have changed
when they haven't.

1.14.2 Solution

Tell tripwire not to compare
inode numbers.

filename -> rule -i ;

For example:

/mnt/windows/system  -> $(SEC_BIN) -i ;

1.14.3 Discussion

Modern Linux kernels do not assign constant inode numbers in VFAT
filesystems.

1.14.4 See Also

The Tripwire manual has detailed documentation on the policy file
format.