I am investigating Tripwire and have stumbled upon something about which I am unsure. In a tripwire report generated after I modified hosts.deny to include an extra #, I noticed the inode number changed from 6969 to 6915. I would like to know why this happened. I know inodes are records which store data about where data is stored on the file system, but would like to know why this number changed for a simple # being inserted.
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
|||||||||
|
|
This is a common method of editing files in Linux. Your editor opened the file, wrote your new changes someplace (with a new inode), and when that file was completely written it linked the hosts.deny location to the new inode. The reason this is done is to prevent file locking issues and to avoid partially clobbering a file. In this way, if I remove a file that's open in a program, that program doesn't end up with garbage data. In fact, as long as an inode is referenced somewhere, it remains in-tact. |
|||
|
