aide --init show lots of errors

Question

I have a brand new centos 6.2 server. The first thing I did is yum -y install aide and then next I did aide --init. Below is a whole lot of errors I got.What does it means must I reinstall it? Or leave it ?

/usr/sbin/prelink: /usr/sbin/lusermod: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/console-kit-daemon: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/NetworkManager: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/rtacct: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/tcpdump: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/dnsmasq: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/getsebool: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/ownership: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/modem-manager: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/pluginviewer: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/sasl2-shared-mechlist: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/ifdhandler: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/mklost+found: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/vpddecode: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/skdump: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/getpcaps: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/lpasswd: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/tmpwatch: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/ck-log-system-stop: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/alternatives: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/avahi-daemon: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/dump-acct: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/luseradd: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/nstat: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/efibootmgr: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/sasldblistusers2: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/e2freefrag: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/sa: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/lgroupadd: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/ss: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/dmidecode: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/sktest: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/fdformat: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/saslpasswd2: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/selinuxenabled: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/pppstats: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/wpa_supplicant: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/capsh: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/togglesebool: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/kppp: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/lgroupmod: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/cracklib-unpacker: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/getcap: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/avcstat: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/lnstat: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/filefrag: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/lid: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/bonobo-activation-sysconf: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/lockdev: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/mcelog: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/cifs.upcall: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/pcscd: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/brctl: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/logrotate: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/wpa_passphrase: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/pppdump: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/lsof: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/ck-log-system-start: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/setcap: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/rtkitctl: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/latencytop: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/wpa_cli: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/saned: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process

yes I did that. So then I run this now /usr/sbin/prelink --all and it does not appear any more? Am I on the right track please help me confirm. What is this prelink error actually? — newbie14, May 27 '12 at 06:16
When I ran the /usr/sbin/prelink this is what I got /usr/sbin/prelink: /usr/lib64/xulrunner-2/libxul.so: DT_JMPREL tag not adjacent to DT_RELA relocations /usr/sbin/prelink: /usr/lib64/xulrunner-2/libmozsqlite3.so: DT_JMPREL tag not adjacent to DT_RELA relocations — newbie14, May 27 '12 at 06:19
looks like some of the libraries got updated without recomputing prelink. The JMPREL/RELA conflict is in a number of bug reports. readelf -d is suggested to check the elf structure, and if really important, relink from source rpm, otherwise ignore. — Dmitri Chubarov, May 27 '12 at 06:40
I did this readelf -d so what option must I choose now. So what is the best solution you suggest? IS it some critical which might corrupt my system in near future? — newbie14, May 27 '12 at 08:50
From what I read (and I do not use prelink at all), the only issue is that firefox start up time will be slightly higher. I.e. not an issue. — Dmitri Chubarov, May 27 '12 at 12:28
@DmitriChubarov this machine wont be using any gui is purely a server. So I do anything about it? Or just go ahead with installing my other stuff? Is it a bug itself? — newbie14, May 27 '12 at 12:34
let us [continue this discussion in chat](http://chat.stackexchange.com/rooms/3572/discussion-between-dmitri-chubarov-and-newbie14) — Dmitri Chubarov, May 27 '12 at 14:48

score 2 · Answer 1 · answered Oct 03 '12 at 21:45

I had the same exact problem after installing a binary that did not use the normal packaging system dependency resolution to properly share libraries. Here are the steps I used to resolve the problem.

First look at the library dependencies for one of the binaries that caused the aide error message. In my case trashapplet:

for LIB in $(ldd /usr/libexec/trashapplet | awk '{print $3}' | grep '^/' | sort -u); do echo $(dirname $LIB); done | sort -u

Next, make sure each directory used by the binary is configured for processing with prelink in /etc/prelink.conf. Add any missing directory to the /etc/prelink.conf. In my case, this was:
```
-l /usr/local/oracle/product/*/lib
```
Repeat as necessary.

In my case the binary hijacked the distro's /lib64/libexpat.so.1 library. Because the new library was located outside the normally-prelinked set but overlapped with the existing library, it caused the mis-match at load time no matter how frequently I prelinked.

Why is this error cause in the first place is it indicating something serious? — newbie14, Oct 05 '12 at 03:18
@newbie14: For some values of "serious": "Did a hacker break in": No. "Could it cause bugs and/or security vulnerabilities?": Probably. Binaries are being loaded against a version of the library they were probably not compiled against. — mormegil, Oct 08 '12 at 18:43
No this is a fresh machine which I did installation and had this issues so what could be the problem ? — newbie14, Oct 10 '12 at 01:52

score 1 · Answer 2 · answered Sep 12 '14 at 14:44

I had this same issue and found the answer through Red Hat (you need an account). Here is what it says:

The message "at least one of file's dependencies has changed since prelinking" means that one of the libraries that the application depends on (perhaps glibc) has been upgraded since last prelink cron job run (which by default runs every 14 days(PRELINK_FULL_TIME_INTERVAL=14 ). Prelink is only able to verify files if their dependencies haven't changed. As soon as it is reprelinked, the errors will go away.

Prelinking only really helps when running applications in a workstation type setup where launching and closing the same application over and over is a common operation. Prelinking doesn't really do anything so server loads where a process is loaded into memory and runs for the duration of the server's uptime.

Prelinking can be disabled by editing /etc/sysconfig/prelink and setting

PRELINKING=no

To undo all the prelink information, run the following command as root:

prelink -ua

Since the problem was on my server, not a workstation, the fix worked perfectly (disabling prelinking in /etc/sysconfig/prelink and running "prelink -ua"). If you want to continue to prelink, make sure that you have a prelink cron job ... it's usually in /etc/cron.daily/ and should've been installed by default with your system. Also make sure that crond service is running and /etc/crontab (or /etc/anacrontab) is configured to execute /etc/cron.daily/. The cron job keeps your prelinking up-to-date or else you get those error messages.

aide --init show lots of errors

2 Answers2