[CentOS] Strange alterations to vim and related packages on KVM host

Wed Jul 4 14:24:56 UTC 2012
James B. Byrne <byrnejb at harte-lyne.ca>

OS CentOS-6.2 with updates to present.

I use git on this host to manage configuration changes and to monitor
package alterations.  This is not meant to be a security check.  It is
simply a way for me to easily recover from fumble fingered
configuration changes.

Yesterday git status reported that the following files had changed
since the previous commit:

#       modified:   ../usr/bin/gdb
#       modified:   ../usr/bin/gvim
#       modified:   ../usr/bin/vim

I therefore reinstalled these three packages using yum reinstall and
committed the change to git.

commit b87a8b2116ef22cc013fd5dc6f525d672d52570a
Author: sysadmin.root.vhost01.hamilton
<sysadmin.root.vhost01.hamilton at harte-lyn
Date:   Tue Jul 3 16:22:34 2012 -0400

    Reinstalled gdb, vim and vim-X11 due to unexpected changes in
executable files.

This morning git reports the same three files have again changed.

# On branch master
# Changed but not updated:
#   (use "git add <file>..." to update what will be committed)
#   (use "git checkout -- <file>..." to discard changes in working
#       modified:   ../etc/virsh.run
#       modified:   .Xauthority
#       modified:   .bash_history
#       modified:   ../selinux/policy
#       modified:   ../usr/bin/gdb
#       modified:   ../usr/bin/gvim
#       modified:   ../usr/bin/vim
# Untracked files:
#   (use "git add <file>..." to include in what will be committed)
#       ../.readahead_collect

When I check the differences git simply reports that the binary files
are difference but, after I reinstalled them all yesterday I noted
that the file modification times of the replaced files and their
respective reinstalled files were the same but their file sizes were

Given what I have committed to the git repository I am satisfied that
these are the only system files that have changed.  None of the files
in /var/log show any entries relating to these files immediately prior
to the reinstall yesterday.  What entries do exist go back to when the
software was first installed and none are more recent than several
months ago.  The git commit on this host previous to yesterday was the
Kernel update on June 19. At that time the subject files were the same
as when they were originally installed.

This host does not accept any direct IP connections from IP addresses
outside our internal server subnet (a.b.c.0/192).   Access is blocked
via IPTables at the gateway and again on the host itself.  Some VM
guests do allow public or otherwise less restricted access but the VM
host itself does not.

I am of course deeply suspicious of these circumstances but I cannot
see how this could be the result of some outside agency. Therefore, I
am at a loss to explain these changes.  What I need to discover is
what agency changed these files and why. In the meantime I have
removed the gdb, vim-enhanced and vim-X11 packages from that host.

Has anyone else run across this sort of behaviour? Has anyone any idea
as to what is going on here?

***          E-Mail is NOT a SECURE channel          ***
James B. Byrne                mailto:ByrneJB at Harte-Lyne.ca
Harte & Lyne Limited          http://www.harte-lyne.ca
9 Brockley Drive              vox: +1 905 561 1241
Hamilton, Ontario             fax: +1 905 561 0757
Canada  L8E 3C3