Am 19.05.2015 um 17:25 schrieb Eric Sandeen:
On 5/19/15 4:14 AM, Reindl Harald wrote:
i switched from "noatime,nodiratime" to "relatime,nodiratime,lazytime" which seems to lead in unexpected mtime changes for a lot of files leading in rkhunter alerts and likely rsync problems
The cargo-cult tuning, it burns! ;)
noatime implies nodiratime, no need to specify both:
and "relatime" implies it too?
touch_atime() { ... if (mnt->mnt_flags & MNT_NOATIME) return; if ((mnt->mnt_flags & MNT_NODIRATIME) && S_ISDIR(inode->i_mode)) return;
different story
and relatime is default, so no need to re-specify:
/* Default to relatime unless overriden */ if (!(flags & MS_NOATIME)) mnt_flags |= MNT_RELATIME;
Anyway ... you didn't say what kernel you were running under, or what filesystem.
surely you just stripped that part from your reply
May 15 13:35:51 Installed: kernel-core-4.0.3-201.fc21.x86_64 May 15 13:35:54 Installed: kernel-modules-4.0.3-201.fc21.x86_64 May 15 13:35:55 Updated: kernel-headers-4.0.3-201.fc21.x86_64
If it's ext4, there have been some flaws there; recently:
yes, "lazytime" implies ext4
commit 8f4d855839179f410fa910a26eb81d646d628f26 Author: Theodore Ts'o tytso@mit.edu Date: Thu May 14 18:19:01 2015 -0400
ext4: fix lazytime optimization We had a fencepost error in the lazytime optimization which means that timestamp would get written to the wrong inode. Cc: stable@vger.kernel.org Signed-off-by: Theodore Ts'o <tytso@mit.edu>
which looks like it's probably the culprit. This was broken since:
commit a26f49926da938f47561f386be56a83dd37a496d Author: Theodore Ts'o tytso@mit.edu Date: Mon Feb 2 00:37:02 2015 -0500
ext4: add optimization for the lazytime mount option
wow - and nobody noticed all the months that mtimes are randomly changing all over the system while it takes exactly one day to get rkhunter mails and rsync listing a ton of untouched files