[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Rooted? Could anything innocently alter the "i" flag?

On Mon, Mar 22, 2004 at 06:21:25PM +0000, Anthony Campbell wrote:
> Recently I found that the "i" flag had been set on /bin/ps. I removed it
> with chattr -i. Now the flag has reappeared!
> Is there any way this could conceivably happen innocently following
> routine upgrades via aptitude? Do I have to do a complete reinstall?

Weird ideas that probably won't work:
1) chattr +i /bin - look for error messages
2) Any of the bastille packages installed?
3) lsof?
4) fix chattr, reinstall, get md5sum, wait


Reply to: