Re: prelinking speed

[Jakub Jelinek <jakub at redhat dot com>]

On Fri, Oct 04, 2002 at 10:13:35AM -0400, Jakub Jelinek wrote:
> On Fri, Oct 04, 2002 at 04:02:00PM +0200, Andreas Jaeger wrote:
> > 
> > Speaking about prelinking: Prelinking changes the binaries themselves
> > and therefore the md5sum is not the same anymore.  This might be a
> > problem for RPM (since you can verify that a program is still the
> > original using the md5sum) and also for security programs that create
> > a database of security related programs.   
> 
> rpm -V works just fine and other security programs can do the same
> what rpm does.
> That's what prelink --verify mode is for.
> It does prelink --undo operation followed by prelink operation and compares
> whether the current binary/library and this undone (supposedly original)
> and then re-prelinked file is identical. If yes, it exits with exit status 0
> after outputing the undone image on its standard output.
> So, if prelink --verify exits with zero exit status, then md5sum
> of its output is identical to md5sum stored in some database, then the file
> was modified by prelink only and nothing else.

Obviously the first step is to verify nobody mucked with prelink itself
or use prelink from some rescue CD. This is one of the reasons why is
prelink statically linked.

	Jakub