[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: root owner (or group) of lot of files in ~erik?



"Karsten M. Self" wrote:
> 
> on Tue, May 22, 2001 at 11:54:42PM -0700, Erik Steffl (steffl@bigfoot.com) wrote:
> >   I have just found out that ~erik/.Xauthority is owned by root and I
> > cannot access my X server (I couldn't run any X applications).
> 
> You every symlink or hardlink this to your root .Xauthority file, by any
> chance?

  no, but I used (as root) xauth -merge ~erik/.Xauthority (I just read
it recently on the list, IIRC it was your advice, I wasn't using it
before so I'm wondering if that could be responsible in some strange
way).

> >   I have no idea how that happened, I have started additional X server
> > as root (startx -- :1), just like many times before, doing some testing
> > of mouse settings.
> >
> >   and now I checked more and I see that huge number of files in my home
> > directory (10813out of 122342 (that includes ., .. and directories) have
> > group set to root. Some files have group set to users. Most of them have
> > group set to erik.
> 
> How'd you start as root?  Did you 'su' or 'su -'?

  su, so it's usually somewhere in ~erik tree but I only su when I
really need it - editing some system wide config files, running apt-get
etc... I never do any regular work as root. note that only group is set
to root, the owner is still erik, when I create file as erik or as root
(us-ed) they have expected owner/group:

jojda:~>cat >rrr
test
jojda:~>ls -l rrr
-rw-r--r--    1 erik     erik            5 May 23 10:12 rrr
jojda:~>su
Password: 
jojda:/home/erik# cat >rrr_root
test
jojda:/home/erik# ls -l rrr_root 
-rw-r--r--    1 root     root            5 May 23 10:12 rrr_root

  none of them is erik/root or erik/users.

> > jojda:~>groups
> > erik disk audio dip www-data video
> > jojda:~>grep erik /etc/passwd
> > erik:x:1000:1000:Erik Steffl,,,:/home/erik:/usr/bin/tcsh
> >
> >   examples of files:
> >
> > -rw-r--r--    1 erik     users     1910784 May  1 23:08
> > Chaos_Uk_-_Skate_Song.3.
> > mp3
> >
> > ...
> >
> > -rw-r--r--    1 erik     root          143 Nov  3  2000 Miro Zbirka -
> > Dr.Jackyl&
> > Mr.Hyde.mp3
> > ...
> > -rw-r--r--    1 erik     users     4390912 Nov  3  2000
> > Miro_Zbirka_-_C'est_La_V
> > ie.mp3
> >
> >   note the same date on the last two of them - it was probably same
> > gnapster session...
> 
> Running gnapster as root?  You play Russian roulette when you're bored
> as well?

  I have been know to pull tiger's tail on occasion (see
http://mtm.host.sk/images/page_01.htm) but I'd never run gnapster (and
most other apps) as root. also note that the other file has group set to
users while user erik is not even member of users:

jojda:~>groups
erik disk audio dip www-data video

  that's what's puzzling me.

  I copied lot of files from old disk (back from when I was using
slackware) so at first I though I screwed it during moving of the files
but these files were created long after move (they were created on the
same day)

> >   most (all?) of the fiels with groups = users was downloaded by
> > napster, but I don't see any pattern to the files where group is set to
> > root.
> 
>     $ find ~ -user root -print0 | xargs -0 ls -ld
> 
> ...and explore for patterns.

  I already did, I see no patterns. as I said, I thouhgt it might have
something to do with my moving partitions and directories around, but
that was long time before some of these files were created (with groups
root and users)

  btw there are no suspicious files owned by root (there are some, mutt
source package etc. I don't use fakeroot), only the groups (root&users)
are suspicious/mysterious.

  take a look at following sample, the date doesn't seem to matter, so
it wasn't some particular event that changed them, it seems like it is
something that's happening all the time. I have no idea what it could
be, though. I su to root ONLY when it's needed (in some cases I could do
without it, setting fakeroot or sudo for particular tasks):

drwx------  106 erik     root         4096 May 23 10:55 .
drwxr-xr-x   14 root     root         4096 May 12 19:32 ..
drwx--S---    2 erik     root         4096 Sep 16  2000 .AbiSuite
drwxr-sr-x    3 erik     root         4096 Apr 28 21:56 .August
drwx--S---    2 erik     root         4096 Oct 20  2000 .BWap
drwx--S---    3 erik     root         4096 Mar 31 13:28 .BitchX
lrwxrwxrwx    1 erik     root           31 Jan 19 00:06
.DCOPserver_jojda -> /home/erik/.DCOPserver_jojda_:0
-rw-------    1 erik     root          104 Apr 14 23:59 .FvConHist
srwxr-xr-x    1 erik     root            0 Apr 14 23:59 .FvConSocket
prw-------    1 erik     erik            0 May 22 21:49 .FvwmCommandC
prw-------    1 erik     erik            0 May 22 21:49 .FvwmCommandM
drwxr-sr-x    3 erik     root         4096 Nov 18  2000 .Latte
drwxr-sr-x    2 erik     erik         4096 Aug  4  2000 .Lin-city
-rw-------    1 erik     root           32 Apr 21 00:53
.MCOP-random-seed
-rw-rw-r--    1 erik     root        23249 May 20 11:54
.RealNetworks_RealMediaSDK_60
-rw-rw-r--    1 erik     root         2276 May 20 11:54
.RealNetworks_RealPlayer_60
-rw-rw-r--    1 erik     root          106 May  4 00:34
.RealNetworks_RealShared_00
-rw-r--r--    1 erik     root          126 Mar 31  2000 .Tipptrainer
drwxr-xr-x    2 erik     erik         4096 May 19 14:59 .Trash
-rw-------    1 erik     root          398 May 22 22:27 .Xauthority
-rw-r--r--    1 erik     root        33047 May 22 14:34 .Xdefaults
lrwxrwxrwx    1 erik     root           10 Apr 16  2000 .Xresources ->
.Xdefaults
-rw-rw-r--    1 erik     root         1954 May 19 13:02 .acrorc

  the files that have group set to users are more 'grouped' together,
e.g. almost everything in directory where I untar downloaded stuff is
set to users except of files created by build process (Makefile, *.o
etc) - that makes some sense. But why would gnapster create files with
groups set to users? or why would ~/mail and all the folders have group
users? I created mail using mkdir and the folders were created using
netscape new folder (IIRC) and/or procmail (I use IMAP server to access
these)

> >   and the most puzzling is the .Xauthority - how could the permission be
> > changed?
> 
> I have my suspicions.

  what is it?

	erik



Reply to: