Re: Rooted? Could anything innocently alter the "i" flag?
On 22 Mar 2004, Brian Brazil wrote:
> On Mon, Mar 22, 2004 at 06:21:25PM +0000, Anthony Campbell wrote:
> > Recently I found that the "i" flag had been set on /bin/ps. I removed it
> > with chattr -i. Now the flag has reappeared!
> >
> > Is there any way this could conceivably happen innocently following
> > routine upgrades via aptitude? Do I have to do a complete reinstall?
>
> Weird ideas that probably won't work:
> 1) chattr +i /bin - look for error messages
> 2) Any of the bastille packages installed?
> 3) lsof?
> 4) fix chattr, reinstall, get md5sum, wait
>
> Brian
>
I'm open to all suggestions!
I did have bastille installed at one stage but not now.
I don't know anything much about lsof or why it might do this.
I'll have to research chattr; I don't know what package it belongs to.
I can't find anything else, so far, that's unusual apart from this, so
I'm rather reluctant to go to radical steps like reinstalling
everything. I compared /bin/ps on another machine which is OK; this was
exactly the same length and date.
Anthony
--
ac@acampbell.org.uk || http://www.acampbell.org.uk
using Linux GNU/Debian || for book reviews, electronic
Windows-free zone || books and skeptical articles
Reply to: