Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up a Linux system with full disk encryption. I've written a script (to run on every boot) which will verify that neither the MBR or /boot partition (ext4) has been modified.

Problem is that every time I boot up the system, my /boot partition hashes differently.

Trying to solve this, I set the /boot partition to mount as read only in fstab. I then took individual hashes of every file on /boot. After I rebooted none of the files had changed (and there were no new files), yet the filesystem hashed as a whole had changed.

I'm guessing there is something behind the scenes which is changed/updated each time the filesystem is mounted? If so, can it be disabled? Should I try with ext3?

Any advice would be greatly appreciated!

Cheers, Lee

share|improve this question

closed as too localized by Marco Ceppi Oct 24 '11 at 22:02

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

I've enabled noatime, in case the access times were causing the difference.. Tried EXT3 on a whim. Tried EXT2 in case it was the journaling that was the problem. No matter what I do the filesystem changes every boot.... – Lee May 22 '11 at 5:37

In dumpe2fs, I can see that there is a piece of information called "Last mount time:". Is it possible that the timestamp get updated whenever you mount it? In that case, it would be normal to see the hash of the partition changed.

share|improve this answer
Nice find, thank you. I will look into this. – Lee May 22 '11 at 7:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.