On Mon, Mar 9, 2009 at 8:56 AM, Bob Netherton <bob.netherton at gmail.com> wrote: > >> Doesn't matter; if you /usr is not mounted then there's no symlink to >> follow. >> > > I think what Christine is saying is that there is no separate /usr. /usr > is in root, so filesystem/root will get that.
Well, it gets weirder. We changed the shell for svc-mdmonitor from /bin/sh to /sbin/sh. Keep in mind we *don't* have separate /usr. The thing works now. What I'm checking is whether or not anything (JASS, perhaps) messed with the link from /bin/sh. On my OS, /bin/sh -> ../../sbin/sh, I don't know what it currently is on the victim box. CT
