On Thu, Sep 11, 2014 at 7:21 PM, Ingo Schwarze <schwa...@usta.de> wrote: > Hi Scott, > > Scott Bonds wrote on Thu, Sep 11, 2014 at 09:38:10AM -0700: > >> My daily insecurity email on one of my boxes says this: >> >> Block device changes: >> brw-r----- 1 root operator 0, 1 Aug 16 17:44:40 2014 /dev/wd0b >> brw-r----- 1 root operator 0, 1 Sep 8 18:43:56 2014 /dev/wd0b >> >> On all my other (openbsd) boxes, the swap partition has the same date as >> all the other block devices. And all the other devices on *this* box >> have the same timestamp of August 16. After this insecurity report, I >> ran a script that eats up memory and started to use swap space and I >> verified that at least in that case, the swap device timestamp didn't >> change...so it would seem that using swap wouldn't lead to the timestamp >> change in my daily insecurity report. >> >> Does anyone know why the date would change on a swap device like this? > > One obvious possibility would be that maybe somebody ran mknod(1) > or touch(1) on the file /dev/wd0b. >
The script /dev/MAKEDEV was run, perhaps? -- chs
