Why small update generates changes in inode numbers?

webcapcha · 2025-02-20 12:04:10

Why these update

[2025-02-18T22:11:12+0200] [PACMAN] Running 'pacman -Syyu'
[2025-02-18T22:11:12+0200] [PACMAN] synchronizing package lists
[2025-02-18T22:11:13+0200] [PACMAN] starting full system upgrade
[2025-02-18T22:11:20+0200] [ALPM] running '05-etckeeper-pre-install.hook'...
[2025-02-18T22:11:20+0200] [ALPM-SCRIPTLET] [master 3aece7c] saving uncommitted changes in /etc prior to pacman run
[2025-02-18T22:11:20+0200] [ALPM-SCRIPTLET]  Author: webd <email@gmail.com>
[2025-02-18T22:11:20+0200] [ALPM-SCRIPTLET]  1 file changed, 2 insertions(+), 1 deletion(-)
[2025-02-18T22:11:20+0200] [ALPM] transaction started
[2025-02-18T22:11:20+0200] [ALPM] upgraded plasma-activities (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:20+0200] [ALPM] upgraded libplasma (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:20+0200] [ALPM] upgraded bluedevil (1:6.3.0-1 -> 1:6.3.1-1)
[2025-02-18T22:11:20+0200] [ALPM] upgraded kdecoration (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:20+0200] [ALPM] upgraded breeze (6.3.0-2 -> 6.3.1-1)
[2025-02-18T22:11:20+0200] [ALPM] upgraded breeze-gtk (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded kactivitymanagerd (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded kde-cli-tools (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded kde-gtk-config (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded kglobalacceld (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded layer-shell-qt (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded libkscreen (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded kscreenlocker (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded kwayland (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded kwin (6.3.0-5 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded kpipewire (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded libksysguard (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded ksystemstats (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded milou (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded ocean-sound-theme (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded plasma-activities-stats (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded plasma5support (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded qqc2-breeze-style (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded xdg-desktop-portal-kde (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:21+0200] [ALPM] upgraded plasma-integration (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:22+0200] [ALPM] upgraded plasma-workspace (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:22+0200] [ALPM] upgraded kdeplasma-addons (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:22+0200] [ALPM] upgraded kmenuedit (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:22+0200] [ALPM] upgraded kscreen (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:22+0200] [ALPM] upgraded obsidian (1.8.4-2 -> 1.8.7-1)
[2025-02-18T22:11:22+0200] [ALPM-SCRIPTLET] You can add custom permanent flags for Obsidian in .config/obsidian/user-flags.conf
[2025-02-18T22:11:22+0200] [ALPM] upgraded polkit-kde-agent (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:22+0200] [ALPM] upgraded powerdevil (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:22+0200] [ALPM] upgraded systemsettings (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:23+0200] [ALPM] upgraded plasma-desktop (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:23+0200] [ALPM] upgraded plasma-pa (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:23+0200] [ALPM] upgraded sddm-kcm (6.3.0-1 -> 6.3.1-1)
[2025-02-18T22:11:23+0200] [ALPM] upgraded spectacle (1:6.3.0-1 -> 1:6.3.1-1)
[2025-02-18T22:11:23+0200] [ALPM] transaction completed
[2025-02-18T22:11:23+0200] [ALPM] running '30-systemd-daemon-reload-user.hook'...
[2025-02-18T22:11:23+0200] [ALPM] running '30-systemd-update.hook'...
[2025-02-18T22:11:23+0200] [ALPM] running '30-update-mime-database.hook'...
[2025-02-18T22:11:24+0200] [ALPM] running 'dbus-reload.hook'...
[2025-02-18T22:11:24+0200] [ALPM] running 'gtk-update-icon-cache.hook'...

in result makes changes in inode numbers?

Right number is a new one

File: /boot/EFI/BOOT/BOOTX64.EFI
 Inode     : 30                               | 33

Directory: /boot/EFI/Lenovo
 Inode     : 37                               | 31

Directory: /boot/EFI/Lenovo/BIOS
 Inode     : 39                               | 35

File: /boot/EFI/Lenovo/BIOS/SelfHealing.fd
 Inode     : 41                               | 37

File: /boot/EFI/systemd/systemd-bootx64.efi
 Inode     : 28                               | 39

File: /boot/amd-ucode.img
 Inode     : 42                               | 26

File: /boot/loader/entries/arch-lts.conf_BAK
 Inode     : 26                               | 43

File: /boot/loader/entries.srel
 Inode     : 24                               | 41

File: /boot/memtest86+/memtest.efi
 Inode     : 31                               | 45

File: /boot/vmlinuz-linux
 Inode     : 43                               | 29

File: /boot/vmlinuz-linux-hardened
 Inode     : 44                               | 27

File: /boot/vmlinuz-linux-lts
 Inode     : 32                               | 28

File: /etc/.updated
 Inode     : 2884870                          | 2884583

Last edited by webcapcha (2025-02-21 09:05:07)

seth · 2025-02-20 21:42:16

touch /tmp/foo
stat -c%i /tmp/foo
rm /tmp/foo
touch /tmp/foo
stat -c%i /tmp/foo

Why do you expect the inode to not change?
Where those files not udpated?

webcapcha · 2025-02-21 05:07:33

❯ touch /tmp/foo

~
❯ stat -c%i /tmp/foo
721

~
❯ rm /tmp/foo
rm: remove regular empty file '/tmp/foo'? y
removed '/tmp/foo'

~ took 3s
❯ touch /tmp/foo

~
❯ stat -c%i /tmp/foo
723

Why do you expect the inode to not change?

From my example in first message I don't see how the update was connected to amd-ucode.img for example. Thus I want understand why it changed. I have another example from yesterday where only one glibc file was updated but again a lot off inodes was changed.

From chatgpt

The inode of a file changes in the following situations:

    File is moved across different filesystems
        If you move (rename) a file within the same filesystem, the inode does not change.
        If you move a file to a different filesystem, a new inode is assigned.

    File is copied
        When you copy a file (cp command), a new file is created, and it gets a new inode.

    File is modified in a way that requires a new inode
        Some operations, like echo "new content" > file, might overwrite the existing file instead of modifying it in place.
        If an application writes a file by creating a temporary file and renaming it (mv temp file), the new file gets a different inode.

    File is hard-linked and then deleted
        Hard links share the same inode.
        If all hard links to an inode are deleted, and a new file is created with the same name, it will have a different inode.

    Filesystem operations that restructure storage
        Some filesystem optimizations (e.g., defragmentation, converting a file to a sparse file, fsck repairs) may lead to inode changes.

seth · 2025-02-21 07:34:41

My money would be on the etckeeper hook - if you want to know *what* touches those files rather than *why* inodes change, see https://wiki.archlinux.org/title/Audit_ … ies_access
Also are you sure *all* those inodes where altered by the update and not just some mandatory fsck during the boot, because most of them are on the (likely FAT!) /boot filesystem.

(It's btw. great to know that chatgpt can read wikipedia and give you useless summary… )

webcapcha · 2025-02-21 09:08:05

Also are you sure *all* those inodes where altered by the update and not just some mandatory fsck during the boot, because most of them are on the (likely FAT!) /boot filesystem.

Absolutely, no reboot after update, just update and inodes changed.

so what to do?

1. temperoray disable etckeeper.hook
2. try to test with that audit access tool

mountaintrek · 2025-02-21 09:10:05

Some ideas:

- See man 7 inode. Section 7 of the man pages has a lot of good doc.
- Use watch and a simple command, like ls -l.
- Use inotifywait in a script to monitor FS events.
- Use find and specify -amin, -atime, -cmin, -ctime, -mmin, and -mtime, or -newermt. Example: find -newermt "1 minute ago".
- Systemd is doing a lot of management of files based on system configuration files, like man systemd-tmpfiles.

Arch Linux

#1 2025-02-20 12:04:10

Why small update generates changes in inode numbers?

#2 2025-02-20 21:42:16

Re: Why small update generates changes in inode numbers?

#3 2025-02-21 05:07:33

Re: Why small update generates changes in inode numbers?

#4 2025-02-21 07:34:41

Re: Why small update generates changes in inode numbers?

#5 2025-02-21 09:08:05

Re: Why small update generates changes in inode numbers?

#6 2025-02-21 09:10:05

Re: Why small update generates changes in inode numbers?

Board footer