0

I'm setting up a Linux system with full disk encryption. I've written a script (to run on every boot) which will verify that neither the MBR or /boot partition (ext4) has been modified.

Problem is that every time I boot up the system, my /boot partition hashes differently.

Trying to solve this, I set the /boot partition to mount as read only in fstab. I then took individual hashes of every file on /boot. After I rebooted none of the files had changed (and there were no new files), yet the filesystem hashed as a whole had changed.

I'm guessing there is something behind the scenes which is changed/updated each time the filesystem is mounted? If so, can it be disabled? Should I try with ext3?

Any advice would be greatly appreciated!

Cheers, Lee

1
  • I've enabled noatime, in case the access times were causing the difference.. Tried EXT3 on a whim. Tried EXT2 in case it was the journaling that was the problem. No matter what I do the filesystem changes every boot....
    – Lee
    May 22, 2011 at 5:37

1 Answer 1

1

In dumpe2fs, I can see that there is a piece of information called "Last mount time:". Is it possible that the timestamp get updated whenever you mount it? In that case, it would be normal to see the hash of the partition changed.

0

Not the answer you're looking for? Browse other questions tagged .