Hi Scott,

Scott Bonds wrote on Thu, Sep 11, 2014 at 09:38:10AM -0700:

> My daily insecurity email on one of my boxes says this:
> 
> Block device changes:
> brw-r----- 1 root operator 0, 1 Aug 16 17:44:40 2014 /dev/wd0b
> brw-r----- 1 root operator 0, 1 Sep 8  18:43:56 2014 /dev/wd0b
> 
> On all my other (openbsd) boxes, the swap partition has the same date as
> all the other block devices. And all the other devices on *this* box
> have the same timestamp of August 16. After this insecurity report, I
> ran a script that eats up memory and started to use swap space and I
> verified that at least in that case, the swap device timestamp didn't
> change...so it would seem that using swap wouldn't lead to the timestamp
> change in my daily insecurity report.
> 
> Does anyone know why the date would change on a swap device like this?

One obvious possibility would be that maybe somebody ran mknod(1)
or touch(1) on the file /dev/wd0b.

Yours,
  Ingo

Reply via email to