Re:Facebook first level interview for Linux admin position
by gcr on Saturday September 28, 2013 @09:36PM
(#6463754)
The question, as written, has no answer. fsck only checks the filesystem. There is no way to check the consistency of the running kernel but a kernel panic is a telltale sign of INconsistency :)
[ Parent
| on HN ]
Re:Facebook first level interview for Linux admin position
by forgeman on Saturday September 28, 2013 @10:04PM
(#6463810)
You can check the consistency of the kernel "file" and compare a MD5 / SHA-1 of known good kernel. Assumption here that the kernel is loaded into healthy hardware. Depends on the spirit of the question. I do agree, running kernel looking at itself... chicken::egg.
Re:Facebook first level interview for Linux admin position
by gcr on Wednesday October 02, 2013 @12:06AM
(#6480554)
For corruption, sure, but rootkits can mess that up by changing the md5 binary to always give the tainted kernel a known checksum.
If a malicious attacker can modify a kernel, no process running within the kernel can check it for consistency.
Re:Facebook first level interview for Linux admin position
by ytjohn on Saturday September 28, 2013 @10:41PM
(#6463891)
I was very confused on this question as well. Seeing both kernel and filesystem there together with the word consistent made me think of a sort of general health. So my answer would have been `iostat`. That would show me the running kernel, cpu utilization, and disk utilization.
Re:Facebook first level interview for Linux admin position
by shabble on Saturday September 28, 2013 @11:45PM
(#6464042)
What happens if you try to fsck /proc or /sys?
I presume 'not much' or 'you get an error', but I don't have an instance I'm prepared to sacrifice right now, just in case something hilariously destructive happens.
Re:Facebook first level interview for Linux admin position
by gcr on Wednesday October 02, 2013 @12:05AM
(#6480548)
fsck doesn't run on a directory, it runs on a block device. You can't run it on /proc or /sys because those aren't backed by a block device. /proc only looks like it has a file system because the kernel "pulls" the "files" out of thin air when you try to access them.