file permission problem

file permission problem

[Charles Hallenbeck]

Hi gang,

Here is a puzzler. In one of my /var/log directories managed by 
logrotate, I have a series of files such as:

check_rootkit.out.xx

where the xx are numbers from 1 to 10. When I do an "ls" in that 
directory, I am told that stat cannot access the file with the number 8 
at the end because I have no permissions. The other files in the group 
have permissions 0600 and are owned by root:root, and I am root when I 
attempt this.

What can be happening here? Is there such a file or not? It does not get 
listed with the other similar ones, and I am not told "does not exist" 
when trying to access, but "no permission". I cannot chown it, or chmod 
it, or ls it, or of course rm it, which is what I would like to do.

Has anyone seen anything like this before? Any clue how to handle this?

Thanks,
Chuck

-- 
The Moon is Waning Gibbous (98% of Full)
But you can still get downloads from http://www.mhcable.com/~chuckh

Re: file permission problem

[Kirk Reiser]

Hi Chuck:  There are extended permission bits and attributes which do
not show up with the usual ls command.  You need to use the chattr for
change attributes command for those extensions so try doing a man
chattr and then try your hand at those.

  Kirk

-- 

Kirk Reiser				The Computer Braille Facility
e-mail: kirk@braille.uwo.ca		University of Western Ontario
phone: (519) 661-3061

Re: file permission problem

[Charles Hallenbeck]

Hi Kirk,

Hmmm ... interesting. But neither chattr nor lsattr can access it 
either. Same refusal. 
On Sun, Jan 15, 2006 at 06:37:39PM -0500, Kirk Reiser wrote:
> Hi Chuck:  There are extended permission bits and attributes which do
> not show up with the usual ls command.  You need to use the chattr for
> change attributes command for those extensions so try doing a man
> chattr and then try your hand at those.
> 
>   Kirk
> 
> -- 
> 
> Kirk Reiser				The Computer Braille Facility
> e-mail: kirk@braille.uwo.ca		University of Western Ontario
> phone: (519) 661-3061
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 
The Moon is Waning Gibbous (98% of Full)
But you can still get downloads from http://www.mhcable.com/~chuckh

Re: file permission problem

[Charles Hallenbeck]

The man pages say that these commands work on ext2 files, but I am using 
a reiserfs file system. Is that why the commands won't work? 
-- 
The Moon is Waning Gibbous (98% of Full)
But you can still get downloads from http://www.mhcable.com/~chuckh

Re: file permission problem

[Charles Hallenbeck]

Here is a snapshot of what happens when I try accessing that file:

hhs48:/var/log/tiger# ls check_rootkit.out.8
ls: check_rootkit.out.8: Permission denied
hhs48:/var/log/tiger# lsattr check_rootkit.out.8
lsattr: Permission denied while trying to stat check_rootkit.out.8
hhs48:/var/log/tiger# rm -f check_rootkit.out.8
rm: cannot remove `check_rootkit.out.8': Permission denied


I guess I'll just keep an eye on it for a while, unless someone thinks 
it should raise some alarm bells or something.

-- 
The Moon is Waning Gibbous (98% of Full)
But you can still get downloads from http://www.mhcable.com/~chuckh

Re: file permission problem

[Adam Myrow]

On Sun, 15 Jan 2006, Charles Hallenbeck wrote:

> hhs48:/var/log/tiger# ls check_rootkit.out.8
> ls: check_rootkit.out.8: Permission denied
> hhs48:/var/log/tiger# lsattr check_rootkit.out.8
> lsattr: Permission denied while trying to stat check_rootkit.out.8
> hhs48:/var/log/tiger# rm -f check_rootkit.out.8
> rm: cannot remove `check_rootkit.out.8': Permission denied

You may have either a failing drive, or corrupt filesystem.  Do a "dmesg" 
and see if there are any strange I/O errors.  Also check /var/log/messages 
for any similar errors.

Re: file permission problem

[Charles Hallenbeck]

Thanks, Adam. Both those things are distinct possibilities. I recently 
was convinced my HD was failing since I had a difficult time getting it 
to boot up after a complete shutdown. I did a backup and asked my HW guy 
to replace it, but what he found was a defective component in the power 
supply instead of a bad disk. We might have both been right. But I have 
a HD I am still nervous about, although no more restart problems.

I'll follow your suggestions.

Chuck


On Sun, Jan 15, 2006 at 08:35:45PM -0600, Adam Myrow wrote:
> On Sun, 15 Jan 2006, Charles Hallenbeck wrote:
> 
> > hhs48:/var/log/tiger# ls check_rootkit.out.8
> > ls: check_rootkit.out.8: Permission denied
> > hhs48:/var/log/tiger# lsattr check_rootkit.out.8
> > lsattr: Permission denied while trying to stat check_rootkit.out.8
> > hhs48:/var/log/tiger# rm -f check_rootkit.out.8
> > rm: cannot remove `check_rootkit.out.8': Permission denied
> 
> You may have either a failing drive, or corrupt filesystem.  Do a "dmesg" 
> and see if there are any strange I/O errors.  Also check /var/log/messages 
> for any similar errors.
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 
The Moon is Waning Gibbous (96% of Full)
But you can still get downloads from http://www.mhcable.com/~chuckh

Re: file permission problem

[Charles Hallenbeck]

Adam,

This morning a second similar problem arose with another file in the 
same directory. I do a nearly complete backup of one HD to another every 
morning using rsync, and those errors only began on Saturday with the 
one I reported yesterday, and now today with a second one. No other such 
error messages in /var/log/messages.

I am using a system security checker called tiger, and the directory 
where the errors are occurring is /var/log/tiger. I am wondering if I 
have a problem with the security checker. I would be interested if 
another error occurs in a different directory, that would be 
informative. I can't completely uninstall tiger since that directory, 
/var/log/tiger, now contains two files that cannot be accessed, 
effectively locking the directory. 

But I could move the entire /var tree, or maybe just the /var/log/tiger 
branch of it, to another partition temporarily to see what happens. The 
problem files would stay behind, but they are only of historic interest, 
and not critical.

One other peculiarity. When I cd to the /var/log/tiger directory and do 
an ls with the output redirected to a file, the errors are not shown. 
Only when I do ls with the name of the given files. The names can be 
only partially entered and tab completion finds them okay, but if I just 
do for instance:

ls > /root/ls.out

the resulting file contains no error messages, and none appear when the 
command is run.

Curios.


On Sun, Jan 15, 2006 at 08:35:45PM -0600, Adam Myrow wrote:
> On Sun, 15 Jan 2006, Charles Hallenbeck wrote:
> 
> > hhs48:/var/log/tiger# ls check_rootkit.out.8
> > ls: check_rootkit.out.8: Permission denied
> > hhs48:/var/log/tiger# lsattr check_rootkit.out.8
> > lsattr: Permission denied while trying to stat check_rootkit.out.8
> > hhs48:/var/log/tiger# rm -f check_rootkit.out.8
> > rm: cannot remove `check_rootkit.out.8': Permission denied
> 
> You may have either a failing drive, or corrupt filesystem.  Do a "dmesg" 
> and see if there are any strange I/O errors.  Also check /var/log/messages 
> for any similar errors.
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 
The Moon is Waning Gibbous (96% of Full)
But you can still get downloads from http://www.mhcable.com/~chuckh

Re: file permission problem

[Kirk Reiser]

I suspect you should unmount that partition and force an fsck on the
partition.  I think Adam may be correct and you are experiencing the
start of diskcurruption.  It is not uncommon for files in a localized
area to start having problems because if a surface abberation starts
it will spread in the same area.  Of course, once you have that
situation it will only get worse not better.

  Kirk

-- 

Kirk Reiser				The Computer Braille Facility
e-mail: kirk@braille.uwo.ca		University of Western Ontario
phone: (519) 661-3061

Re: file permission problem

[Charles Hallenbeck]

I bet you are right. I think I will go ahead and replace the disk and 
not wait for the other shoe to drop. 

On Mon, Jan 16, 2006 at 08:09:48AM -0500, Kirk Reiser wrote:
> I suspect you should unmount that partition and force an fsck on the
> partition.  I think Adam may be correct and you are experiencing the
> start of diskcurruption.  It is not uncommon for files in a localized
> area to start having problems because if a surface abberation starts
> it will spread in the same area.  Of course, once you have that
> situation it will only get worse not better.
> 
>   Kirk
> 
> -- 
> 
> Kirk Reiser				The Computer Braille Facility
> e-mail: kirk@braille.uwo.ca		University of Western Ontario
> phone: (519) 661-3061
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 
The Moon is Waning Gibbous (96% of Full)
But you can still get downloads from http://www.mhcable.com/~chuckh

Re: file permission problem

[Tyler Spivey]

Just a thought, this probably won't work, but have you tried chmod'ing
the file to a mode that you can access?

Re: file permission problem

[Charles Hallenbeck]

Yes, chmod fails the same way, as does chown.

On Sun, Jan 15, 2006 at 10:01:27PM -0800, Tyler Spivey wrote:
> Just a thought, this probably won't work, but have you tried chmod'ing
> the file to a mode that you can access?
> 
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 
The Moon is Waning Gibbous (96% of Full)
But you can still get downloads from http://www.mhcable.com/~chuckh

Re: file permission problem

[Ralph W. Reid]

Hmmm...that 'file' seems to be behaving more like a directory.  Try
'ls -ld check_rootkit.out.8' to see what happens.

HTH, and have a _great_ day!

On Sun, Jan 15, 2006 at 07:16:01PM -0500, Charles Hallenbeck wrote:
> Here is a snapshot of what happens when I try accessing that file:
> 
> hhs48:/var/log/tiger# ls check_rootkit.out.8
> ls: check_rootkit.out.8: Permission denied
> hhs48:/var/log/tiger# lsattr check_rootkit.out.8
> lsattr: Permission denied while trying to stat check_rootkit.out.8
> hhs48:/var/log/tiger# rm -f check_rootkit.out.8
> rm: cannot remove `check_rootkit.out.8': Permission denied
> 
> 
> I guess I'll just keep an eye on it for a while, unless someone thinks 
> it should raise some alarm bells or something.
> 
> -- 
> The Moon is Waning Gibbous (98% of Full)
> But you can still get downloads from http://www.mhcable.com/~chuckh
> 
> _______________________________________________
> Speakup mailing list
> Speakup@braille.uwo.ca
> http://speech.braille.uwo.ca/mailman/listinfo/speakup

-- 
Ralph.  N6BNO.  Wisdom comes from central processing, not from I/O.
rreid@sunset.net  http://personalweb.sunset.net/~rreid
...passing through The City of Internet at the speed of light!
CIRCLE AREA = _pi * r ^ 2