Package: aide Version: 0.16.1-1 Severity: normal Hi,
this might be a bug or a user error. aide --update reports: --------------------------------------------------- Removed and changed entries: --------------------------------------------------- d ... n .. : /run <snip> --------------------------------------------------- Detailed information about changes: --------------------------------------------------- Directory: /run Linkcount: 19 | 18 while I think that I have explicitly excluded the link count: @@ifndef RUN @@define RUN run @@ifndef RUNLOCK @@define RUNLOCK run/lock /@@{ROOTPREFIX}@@{RUN}/acpid\.(socket|pid)$ VarFile !/@@{ROOTPREFIX}@@{RUN}/aide$ <snip a lot of lines that reference @@{RUN}/foo but never @@{RUN}$ /@@{ROOTPREFIX}@@{RUNLOCK}/\.ramfs$ VarFile /@@{ROOTPREFIX}@@{RUNLOCK}$ VarDirInode /@@{ROOTPREFIX}@@{RUN}$ VarDirInode-n Since the last rule is the only rule that applies to /run, it should be the one that counts. VarDirInode = OwnerMode+n+acl+xattrs+e2fsattrs+selinux so that would expand to /@@{ROOTPREFIX}@@{RUN}$ OwnerMode+n+acl+xattrs+e2fsattrs+selinux-n Maybe aide doesn't grok the +n-n that is written here? Greetings Marc -- System Information: Debian Release: buster/sid APT prefers testing APT policy: (500, 'testing') Architecture: amd64 (x86_64) Kernel: Linux 5.0.5-zgsrv20080 (SMP w/2 CPU cores; PREEMPT) Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8), LANGUAGE=en (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) aide depends on no packages. Versions of packages aide recommends: ii aide-common 0.16.1-1 Versions of packages aide suggests: ii figlet 2.2.5-3 -- no debconf information