Re: Rooted? Could anything innocently alter the "i" flag?
On Mon, Mar 22, 2004 at 06:21:25PM +0000, Anthony Campbell wrote:
> Recently I found that the "i" flag had been set on /bin/ps. I removed it
> with chattr -i. Now the flag has reappeared!
>
> Is there any way this could conceivably happen innocently following
> routine upgrades via aptitude? Do I have to do a complete reinstall?
Weird ideas that probably won't work:
1) chattr +i /bin - look for error messages
2) Any of the bastille packages installed?
3) lsof?
4) fix chattr, reinstall, get md5sum, wait
Brian
Reply to: