/dev/null change's permission

[Willie Wright]

Hi,
Here is the problem the /dev/null file change's permission on it's own from 666 to 600.

Any help would be helpfull.

Thanks willie wright

[A. Clay Stephenson]

Hi Willie:

/dev/null did not change on its own; some process did it. I would first make sure that /dev/null is still a character device node and not a regular file. If you can examine the file's ctime to reveal when the file was created or chmod that might give you a clue.

Clay

[James R. Ferguson]

Hi Willie:

In the event that you find /dev/null has been recreated as a regular file, remove it and recrete it thusly:

# mknod /dev/null c 3 0x000002
# chmod 666 /dev/null
# chown bin:bin /dev/null

...JRF...

[John Poff]

Hello,

At least the /dev/null file stayed there. I once had a system where the /dev/null special file was nuked and replaced with a regular file. My first clue was when the / filesystem filled up.

I agree with Clay. I would try to find out who or what changed the file. That would make me very nervous if it happened to one of my systems.

JP

[Willie Wright]

Hi All,

Yes /dev/null is a character device node.
(crw------- bin bin 3 0x000002 Jul 26 05:45 /dev/null)

After doing fuser /dev/null, I see over 75 process running at that time.

I'm not sure if the ctime command will show me which process is doing this or not.
Also I did a man page on the ctime command, but I'm not sure on how to use it.

Thanks for any more help.


Thanks willie wright

[James R. Ferguson]

Hi Willie:

If you do an 'ls -lc' you will see the last last modification of the inode (i.e the file was created, or its mode changed, etc.). Beware, however, that some backup software will reset the last-access timestamp and in so doing will cause the last change timestamp to be updated.

...JRF...

[Willie Wright]

Hi All,

I ran this for loop
for process in `cat null_process`^Jdo^Jps -ef|grep $process|grep -v wwright|grep -v root^Jdone

I noticed that following directories & process were owned by bin bin.

/opt/CSCOpx/objects/
/opt/CSCOpx/objects/web/bin/web_server
/opt/OV/httpd/bin/httpd

I think that one of many process may the guilty party.

Tell me what you think.

Thanks willie wright