[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Can't delete or modify file

> On Wed, Apr 18, 2001 at 05:12:33PM +0200, Marcin Sochacki wrote:
> > On Wed, Apr 18, 2001 at 10:00:02AM -0400, Robert Brown wrote:
> > > br-xr-S-wx    1 22304    8236     105, 114 Oct 23  2030 libnss_db.so.2
> > > I've tried to delete, rename, chown and chmod with out any luck.  What should I
> > > do?  I can't even find out what 'S' as a permission is.  Any help would be
> > > greatly appreciated.
> > 
> > man chattr
> Or maybe better fsck.

Chattr is the right direction. A very frustrating lesson tought to me by a
hacker on one of my machines. I couldnt replace the files he had modified
until I found his .history file and viewed it. The man on chattr isnt very
good. It will explain alittle about the S and s

To make a file unchangeable even by root you do
chattr +i filename
to make it changeable again (delete, overwrite, etc)
chattr -i filename

(that lib was one of the files the hackers modified, maybe you should run
some checks such as
file /dev/* | grep -i asc
find / |grep t0rn
find / |grep bnc

Gandalf  Parker

Reply to: