HP-UX Reference (11i v1 00/12) - 1M System Administration Commands N-Z (vol 4)

__________________________________________________________________________________________________________________________________________________________________________________________________
__________________________________________________________________________________________________________________________________________________________________________________________________
STANDARD Printed by: Nora Chuang [nchuang] STANDARD
/build/1111/BRICK/man1m/naaagt.1m
________________________________________________________________
___ ___
p
pdfck(1M) pdfck(1M)
NAME
pdfck - compare Product Description File to File System
SYNOPSIS
pdfck [-n ][-r alternate_root] PDF
DESCRIPTION
pdfck is a program that compares the file descriptions in a PDF (Product Description File) to the actual
files on the file system. It is intended as a tool to audit the file system and detect corruption and/or tamper-
ing. Differences found are reported in the format described in the pdfdiff(1M) manual entry. (Size growth
(-p option) is not reported.) For a detailed explanation of the PDF fields see pdf(4). The command
pdfck -r /pseudoroot /system/AL_CORE/pdf
is roughly equivalent to
mkpdf -r /pseudoroot /system/AL_CORE/pdf - | \
pdfdiff /system/
AL_CORE/pdf -
Options
pdfck recognizes the following options:
-n Compare numerical representation of user id uid and group id gid of each file,
instead of the usual text representation. If owner or group is recorded in the
PDF as a name, look the name up in the /etc/passwd or /etc/group file,
respectively, to find the id number.
-r alternate_root alternate_root is a string that is prefixed to each pathname in the prototype
when the filesystem is being searched for that file. Default is
NULL.
EXAMPLES
The following output indicates tampering with /usr/bin/cat:
/usr/bin/cat: mode(-r-xr-xr-x -> -r-sr-xr-x)(became suid), size(27724 -> 10345),
checksum(1665 -> 398)
WARNING
Use of PDFs is discouraged since this functionality is obsolete and is being replaced with Software Distribu-
tor (see sd(4)).
FILES
/system/fileset_name/pdf Product Description File of fileset called fileset_name.
SEE ALSO
mkpdf(1M), pdfdiff(1M), pdf(4).
HP-UX Release 11i: December 2000 1 Section 1M633
___
___