Re: [Solved} Re: procps broken? dpkg can't process it.
On 21 Mar 2004, Ken Bloom wrote:
> On 2004-03-21, Anthony Campbell <ac@acampbell.org.uk> wrote:
> > On 21 Mar 2004, Anthony Campbell wrote:
> >> For some time there have been errors processing procps. Using aptitude I'm getting:
> >> --------------------------
> >> (Reading database ... 82789 files and directories currently installed.)
> >> Preparing to replace procps 1:3.1.14-1 (using .../procps_1%3a3.2.0-1_i386.deb) ...
> >> Unpacking replacement procps ...
> >> dpkg: error processing /var/cache/apt/archives/procps_1%3a3.2.0-1_i386.deb (--unpack):
> >> unable to make backup link of `./bin/ps' before installing new version: Operation not permitted
> >> dpkg-deb: subprocess paste killed by signal (Broken pipe)
> >> Setting kernel variables.net.ipv4.tcp_ecn = 0
> >>
> >> Errors were encountered while processing:
> >> /var/cache/apt/archives/procps_1%3a3.2.0-1_i386.deb
> >> E: Sub-process /usr/bin/dpkg returned an error code (1)
> >> Ack! Something bad happened while installing packages. Trying to recover:
> >> Press return to continue.
> >> -------------------------------
> >>
> >> Anyone know what is happening here? This on testing, kernel 2.4.24.
> >>
> >
> > Using lsattr I finally discovered that the "i" attribute had been set on
> > /bin/ps. I've no idea how this happened but removing it with chattr -i
> > made everything work again.
> >
> > AC
> >
>
> Please install and run chkrootkit. I can't imagine why /bin/ps would
> have the i attribute set if you don't remember it - you may have been
> rooted.
>
Thanks for this pointer. However, chkrootkit does not show anything
amiss.
AC
--
ac@acampbell.org.uk || http://www.acampbell.org.uk
using Linux GNU/Debian || for book reviews, electronic
Windows-free zone || books and skeptical articles
Reply to: