In comp.sys.raspberry-pi, Chris Elvidge   wrote:
> On 07/12/2018 14:43, Adrian wrote:
>> echo `date` 
> try:
> $ date +"%c state change message"

If the state change message ever contains a % that will have unexpected
output, whereas the original will not.

To summarize the original problem, cron every minute runs a script
something like:

    #!something
    date +%H:%M     # known command
    check_state     # undisclosed command
    if state_change    # undisclosed test
       echo `date`  # known command
    fi
    who_knows_what    # undisclosed further actions

Which is generating logs like:

 06:27

 06:28
 Dat Output 06:38 STATE CHANGED MESSAGE

 06:29

I'm wondering what the check_state command is, and if it could ever take
N > 1 (eg 10) minutes. And if it could, how is this log assembled to get
a backwards jump in a timestamp.

Or if check_state has some sort of side effect that changes the system
clock, and then it gets changed back in who_knows_what. Or if
check_state has a side effect that changes the PATH.

An "strace -f" of the whole cron script would be interesting. It would
show if different versions of "date" are being used and would also show
if something was changing the system clock (from the script).

But it wouldn't help if the check_state command is just very slow and
the date descrepancy is hidden by the way the output is assembled.

Elijah
------
trying to think of other ways data could be subverted

--- SoupGate-Win32 v1.05