On Thu, Jan 21, 2021 at 11:25:30AM +0100, Roberto Ragusa wrote:
On 1/21/21 12:29 AM, Patrick マルタインアンドレアス Uiterwijk wrote:
> On installation of two different VMs, one with the resigned RPMs, and one
> with the resigned+ima RPMs, the /usr directory size does not change at all
> (both are exactly 1417064 bytes).
How is this physically possible? (and one million bytes for a directory
makes no sense, I wonder what measurement this is)
The signatures are stored in file extended attributes. Some file systems
inline short extended attributes into i-node data structure. It could happen
then the signature was placed into alignment gaps of the inode table resulting
into no increase of the occupied blocks.
But a simpler explanation could be that the used file system forgets to count
extended attributes into stat.st_blocks value. We really need to know the
details.
-- Petr