Install from RPM, then files change. How can I see the differences?

Question

This is a RedHat Enterprise 5.5 system. I ran a verification check against an RPM, and it looks like two files have changed:

# rpm --verify shadow-utils 
S.5....T  c /etc/default/useradd
S.5....T  c /etc/login.defs

I have access to the RPM which originally installed these files. Can diff these changed files against the version which is stored in the RPM?

Answer 1

You can extract the contents of the RPM to the disk (and not into / but some other directory). I use mc for this, where you can enter a rpm-file like a directory and extract the files you need. To extract the whole RPM into the current directory you might do something like

rpm2cpio yourrpm.rpm | cpio -idmv

Answer 2

In my experience, it is normal for RPM to complain about assorted files even after a pristine install. Never looked further into it.