/sbin/SuSEconfig can change permissions on things based on the settings in /etc/permissions* and /etc/sysconfig/security Could you have changed those things and run it? (or yast2 ran it after changing something else).
Marcy Cortes "This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose, or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation." -----Original Message----- From: Linux on 390 Port [mailto:[EMAIL PROTECTED] On Behalf Of John Summerfield Sent: Monday, January 14, 2008 4:11 PM To: LINUX-390@VM.MARIST.EDU Subject: Re: [LINUX-390] Linux not recognizing file systems Joell Chockley wrote: > I've got a strange problem with a Linux guest. The only indicator > we've come up with so far is that /dev/null had it's file permissions > changed on Friday afternoon to -rw-r--r-- 1 root root 81 2008-01-11 > 15:03 /dev/null (we don't know how this was changed). One of our > admins changed it back to > This is what I would expect to see if someone deleted /dev/null and then root did something like echo >/dev/null as you would expect root to do sometimes - just look at /etc/init.d/* grep /dev/null /etc/init.d/* _I_ would like to know who|what deleted /dev/null and what else was done, it sounds to me like a breakdown in procedures, or some malware was installed. -- Cheers John -- spambait [EMAIL PROTECTED] [EMAIL PROTECTED] -- Advice http://webfoot.com/advice/email.top.php http://www.catb.org/~esr/faqs/smart-questions.html http://support.microsoft.com/kb/555375 You cannot reply off-list:-) ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
