On Thu, 25 Jan 2001, Mike Pelley wrote:
> Folks,
>
> I'm cleaning up a system that was hacked (curses on wu-ftp!). There are a
> number of files that cannot be reverted to their non-hacked form,
> specifically, /bin/ps and /bin/netsat. If I try to delete them, for example
> /bin/ps, I get this error:
> rm: cannot unlink `ps': Operation not permitted
> I've taken a look at status and get:
> File: "/bin/ps"
> Size: 33281 Filetype: Regular File
> Mode: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/
> root)
> Device: 48,1 Inode: 108742 Links: 1
> Access: Thu Jan 25 03:38:03 2001(00000.01:02:45)
> Modify: Mon Jan 15 13:12:44 2001(00009.15:28:04)
> Change: Mon Jan 22 19:47:13 2001(00002.08:53:35)
>
> So, I guess this means that the file has a hard link to some other file.
> Then I did a search for that inode:
> find / -inum 108742 -print
> but I don't find any other files that are linked to it!
>
> There has to be some way to delete these files. What am I missing?
>
> HELP!
>
> Thanks in advance.
>
> Cheers,
> Mike
>
I can only help a little. The Links: 1 means that there is only one
directory entry for the file. If there was a hard link to it, it would
say Links: 2. Also, even if there was another hard link, you would
still be able to delete the /bin/ps link - the inodes would still be in
use by the other directory entry, but the link cound would be lowered.
The file probably has the "i" attribute set on it. See what lsattr has
to say about it. In any case, your best bet is to backup your date, and
reformat the drive. You never know what may be hidden on the disk some
ware. It isn't worth the risk!
Mikkel
--
Do not meddle in the affairs of dragons,
for you are crunchy and taste good with ketchup.
_______________________________________________
Redhat-list mailing list
[EMAIL PROTECTED]
https://listman.redhat.com/mailman/listinfo/redhat-list
