HP-UX Reference (11i v1 05/09) - 1M System Administration Commands N-Z (vol 4)

pdfck(1M) pdfck(1M)

NAME

pdfck - compare Product Description File to File System

SYNOPSIS

pdfck [ -n ][-r alternate_root ]

PDF

DESCRIPTION

pdfck is a program that compares the ﬁle descriptions in a

PDF (Product Description File) to the actual

ﬁles on the ﬁle system. It is intended as a tool to audit the ﬁle system and detect corruption and/or tamper-

ing. Differences found are reported in the format described in the pdfdiff(1M) manual entry. (Size growth

(

-p option) is not reported.) For a detailed explanation of the

PDF ﬁelds see pdf(4). The command

pdfck -r /pseudoroot /system/AL_CORE/pdf

is roughly equivalent to

mkpdf -r /pseudoroot /system/AL_CORE/pdf - | \

pdfdiff /system/

AL_CORE/pdf -

Options

pdfck recognizes the following options:

-n Compare numerical representation of user id uid and group id gid of each ﬁle,

instead of the usual text representation. If owner or group is recorded in the

PDF as a name, look the name up in the /etc/passwd or /etc/group ﬁle,

respectively, to ﬁnd the id number.

-r alternate_root alternate_root is a string that is preﬁxed to each pathname in the prototype

when the ﬁlesystem is being searched for that ﬁle. Default is

NULL.

EXAMPLES

The following output indicates tampering with /usr/bin/cat :

/usr/bin/cat: mode(-r-xr-xr-x -> -r-sr-xr-x)(became suid), size(27724 -> 10345),

checksum(1665 -> 398)

WARNING

Use of PDFs is discouraged since this functionality is obsolete and is being replaced with Software Distribu-

tor (see sd(4)).

FILES

/system/fileset_name/pdf Product Description File of ﬁleset called ﬁleset_name.