Linux Security Cookbook

1.14. Checking Windows VFAT Filesystems

Problem

When checking the integrity of a VFAT filesystem, tripwire always complains that files have changed when they haven’t.

Solution

Tell tripwire not to compare inode numbers.

               filename -> rule -i ;

For example:

/mnt/windows/system  -> $(SEC_BIN) -i ;

Discussion

Modern Linux kernels do not assign constant inode numbers in VFAT filesystems.

See Also

The Tripwire manual has detailed documentation on the policy file format.