topic Re: /dev/null change's permission in Operating System - HP-UX

/dev/null change's permission

Willie Wright — Wed, 25 Jul 2001 21:24:06 GMT

Hi,
Here is the problem the /dev/null file change's permission on it's own from 666 to 600.

Any help would be helpfull.

Thanks willie wright

Re: /dev/null change's permission

A. Clay Stephenson — Wed, 25 Jul 2001 22:15:54 GMT

Hi Willie:

/dev/null did not change on its own; some process did it. I would first make sure that /dev/null is still a character device node and not a regular file. If you can examine the file's ctime to reveal when the file was created or chmod that might give you a clue.

Clay

Re: /dev/null change's permission

James R. Ferguson — Wed, 25 Jul 2001 22:57:43 GMT

Hi Willie:

In the event that you find /dev/null has been recreated as a regular file, remove it and recrete it thusly:

# mknod /dev/null c 3 0x000002
# chmod 666 /dev/null
# chown bin:bin /dev/null

...JRF...

Re: /dev/null change's permission

John Poff — Wed, 25 Jul 2001 23:11:19 GMT

Hello,

At least the /dev/null file stayed there. I once had a system where the /dev/null special file was nuked and replaced with a regular file. My first clue was when the / filesystem filled up.

I agree with Clay. I would try to find out who or what changed the file. That would make me very nervous if it happened to one of my systems.

JP

Re: /dev/null change's permission

Willie Wright — Thu, 26 Jul 2001 14:12:33 GMT

Hi All,

Yes /dev/null is a character device node.
(crw------- bin bin 3 0x000002 Jul 26 05:45 /dev/null)

After doing fuser /dev/null, I see over 75 process running at that time.

I'm not sure if the ctime command will show me which process is doing this or not.
Also I did a man page on the ctime command, but I'm not sure on how to use it.

Thanks for any more help.

Thanks willie wright

Re: /dev/null change's permission

James R. Ferguson — Thu, 26 Jul 2001 14:22:37 GMT

Hi Willie:

If you do an 'ls -lc' you will see the last last modification of the inode (i.e the file was created, or its mode changed, etc.). Beware, however, that some backup software will reset the last-access timestamp and in so doing will cause the last change timestamp to be updated.

...JRF...

Re: /dev/null change's permission

Willie Wright — Thu, 26 Jul 2001 14:50:50 GMT

Hi All,

I ran this for loop
for process in `cat null_process`^Jdo^Jps -ef|grep $process|grep -v wwright|grep -v root^Jdone

I noticed that following directories & process were owned by bin bin.

/opt/CSCOpx/objects/
/opt/CSCOpx/objects/web/bin/web_server
/opt/OV/httpd/bin/httpd

I think that one of many process may the guilty party.

Tell me what you think.

Thanks willie wright