[Aide] Aide alerts - Aide detects files added that are already present on the Filesystem

[M D]

Hi,
I am using an ARM based environment with a NAND Flash using a JFFS2 filesystem.

I have aide configured with p+i+u+n+s for /root

1) I observe in some instances that files that are already present are
detected as added.
2) In some cases, the same file is detected as added and removed
3) In some cases, I observe database read errors such as
gzread() failed: gzerr=: Input/output error!
Not enough parameters in db:531

Could not read permissions from database. String 10064t
Could not read permissions from database. String 10075u
AIDE 0.15.1 found differences between database and filesystem!!
Start timestamp: 2018-01-02 11:13:02

Summary:
Total number of files: 2049
Added files: 1
Removed files: 1
Changed files: 2


---------------------------------------------------
Added files:
---------------------------------------------------

f++++++++++++: /lib/modules/kernel/drivers/net/usb/cdc_ncm.ko

---------------------------------------------------
Removed files:
---------------------------------------------------

f------------: /lib/modules//kernel/drivers/net/usb/cdc_ncmnko

---------------------------------------------------
Changed files:
---------------------------------------------------

f =.p. ...: /root/.bash_profile

From my analysis, I would dismiss these are false positives. However I
wanted to understand how aide detects these alerts. Is aide not
compatible with NAND flash and jffs2?

To rule such error alerts out in the future is there any
recommendation in terms of something I can do in the aide conf? Is
this something I can do in terms of compilation?

Regards.
Max

[M D]

Thank you for the explanation of the bit flip. I initially dismissed
it as some typo in the report that aide generated. I will check the
status of the filesystem.

Thank you once again very much.

Regards,
Max

Post by M D
I am using an ARM based environment with a NAND Flash using a JFFS2 filesystem.
I have aide configured with p+i+u+n+s for /root
1) I observe in some instances that files that are already present are
detected as added.
2) In some cases, the same file is detected as added and removed
3) In some cases, I observe database read errors such as
gzread() failed: gzerr=: Input/output error!

This is usually a sign of filesystem corruption or an hardware issue.
Are you sure your system is ok?

Post by M D
f++++++++++++: /lib/modules/kernel/drivers/net/usb/cdc_ncm.ko
f------------: /lib/modules//kernel/drivers/net/usb/cdc_ncmnko

That's not the same file. Since the file cdc_ncmnko is reported as
"removed", I suspect that there was a bit flip in the database.
n is 0x6e 01101110
. is 0x2e 00101110
So this is a clear bit flip. I'd distrust the system here.
Greetings
Marc
--
-----------------------------------------------------------------------------
Marc Haber | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421
_______________________________________________
Aide mailing list
https://www.ipi.fi/mailman/listinfo/aide