Getting diffs for file changes detected by rpm -V
I have an installation that has been tampered with, and I want to find out what exactly has been changed.
I can run
rpm -V MY_PACKAGES
which gives me a list of modified files. Now I am looking for a convenient way to see the diffs (assuming that all files have textual content) against the original rpms (which I have available).
What would be the easiest way of doing this, given that I am dealing with ~20 packages and ~200 changed files. Is there something like "rpm diff"???
#
# Install yumdownloader
#
yum install yum-utils
#
# search modified files (in this case: from pam_ldap)
#
rpm -V pam_ldap
S.5....T. c /etc/pam_ldap.conf
#
# make tmp-dir and download rpm
#
mkdir Temp
cd Temp
yumdownloader pam_ldap
#
# extract rpm to current folder
#
rpm2cpio pam_ldap-185-11.el6.x86_64.rpm | cpio -idmv
#
# check diff
#
diff etc/pam_ldap.conf /etc/pam_ldap.conf
rpm -V explained:
c %config configuration file.
d %doc documentation file.
g %ghost file (i.e. the file contents are not
included in the package payload).
l %license license file.
r %readme readme file.
S file Size differs
M Mode differs (includes permissions and file type)
5 MD5 sum differs
D Device major/minor number mismatch
L readLink(2) path mismatch
U User ownership differs
G Group ownership differs
T mTime differs