[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Rooted? Could anything innocently alter the "i" flag?



On Tue, Mar 23, 2004 at 08:52:35AM +0000, Anthony Campbell wrote:
> On 23 Mar 2004, Mark McRitchie wrote:
> > 
> > 
> > > -----Original Message-----
> > > From: Anthony Campbell [mailto:ac@acampbell.org.uk]
> > > Sent: 22 March 2004 20:07
> > >
<snip>
> because a routine upgrade of procps failed because it could not make a
> link to /bin/ps. I eventually found that it was due to the "i" flag on
> that file. I removed the flag and it then worked. However, last night I
> found that the flag had returned. I removed it again. 
> 
> Today, I found that upgrading procps failed again, this time because it
> was unable to create /bin/kill. But /bin/kill does not have the "i" flag
> set. So it definitely seems that something strange is happening.
> 
> AC
Hi Anthony,
Are any script run in cron jobs? 
Are there any pacakges installed that are related to
security/administration? Check 'dpkg -l'. Maybe you would like a file
alteration program like fam installed?
Just a thought.
-Kev

Attachment: signature.asc
Description: Digital signature


Reply to: