Re: root is unable to change file permissions!

[Jurgen Stroo <blurg@JurgenStroo.com>]

Try to run a chkrootkit, to see if some niaries are replaced.
Also, how about the mounts, is /bin probably a mount, or is
/bin/login a symlink to a ro filesystem?

Jurgen



> Hello Debain Users,
>
> We have an interesting phenomenon occuring on one of our servers. We have noticed that two files in the /bin directory have had their executable permissions removed and we are unable to chmod the files as root.
>
> current file permissions:
> -rw-r--r--   1 root     root        35464 May 31 13:02 /bin/login
> -rw-r--r--   1 root     root        54152 Aug 29  2001 /bin/netstat
>
> when trying to change permissions:
>
> ns:~# whoami
> root
>
> ns:~# id
> uid=0(root) gid=0(root) groups=0(root)
>
> ns:~# chmod 755 /bin/login
> chmod: changing permissions of `/bin/login': Operation not permitted
>
> We have tried doing the same thing from the rescue disc login prompt. same outcome.
>
> This seems to be a serious security issue. Root user seems to have lost control of some files. Other files can be changed using the above commands.
>
> Any ideas?
>
> Best regards,
>
> Andreas Hatz
>