Robert E. Blair wrote:
..
> At first I thought I had been hacked but it is consistent across several
> systems and even the md5sum for (take this example /bin/bash) the files
> appears to vary from system to system.  Is there an acl issue here?  If
> this is it how do you tell md5sum to ignore the extra file data?  I know
> that rpm is consistent in that a change in the file will lead to a "5"
> in the verify.  Anyone have a clue as to why this would be or how to
> construct an equivalent sum?

If this is SL4, you might be running into "prelink"ed binaries.
Use "prelink -y /bin/bash | md5sum" to undo the prelinking and compute
the checksum of the current file on disk. An error means that the
prelinked file has been tampered with.