System executables found in /etc

[Raynald Boucher]

Hello all,

I listed the /etc directory on one of our servers and found system executables in it (ex vgcreate, vgdisplay etc).
Surprised, I checked on other systems and found the same thing.

Is this a standard practice or does some "normal" process copy the contents of /usr/sbin and /usr/bin into the /etc directory?
If so, what is the benefit?

I checked a few files and they have identical checksums. It is safe to delete them from /etc?

Thanks

RayB

[Jeff_Traigle]

Are you sure they are the actual executables or are they symlinks to the binaries in /usr/sbin?

The symlinks are there in 11.11 and 11.23. Looks like the transition support for the old location in /etc has finally been removed in 11.31, the symlinks don't exist.

[Pete Randall]

Ray,

I believe a closer examination will reveal these to be symbolic links to the actual executables in /usr/sbin. These were transition links put in place when the filesystem layout was revamped from release 9 to release 10 so people could use the /etc/version they were used to.


Pete

[TwoProc]

Man... the only executable in /etc that I have is /etc/profile, and that is a script - not a program.

I believe that in the past some sysadmin has decided that he wanted his executables in /etc.

Hopefully, /etc isn't in anyone's path - and so it wouldn't matter. The bad part here is the possibility of running old versions of admin tools against more newly patched OSs and OS libraries, data structures, etc.

I'd be looking at doing a patch verify to see that all patches verify where their components are.

Then maybe start doing diffs between any executables in /etc and comparing to real versions out in /sbin, etc.

After making sure that every executable has a live and presumably correct counterpart, make a directory somewhere with no rwx permissions to it and drop all of the executables there, just for safekeeping in case you need one.

At the same time, I'd be making sure that /etc was not part of anyone's path. If you find someone (like an admin) that has it, then you've probably found your errant admin.

After cleaning all of this up, I'd try to get "new" versions of everything. Update to the latest recommended versions of most anything you find in there, and then see if you can force reinstall on top of anything else.

The good news is, whomever did this, did it on other servers (hopefully test servers), so you try this approach on some of them and make sure everything is OK for a while before you hit production servers. Just get familiar with the common scenario and problems before you tackle production.

Keep in mind that if you need to see a "version" of most any compiled command - you can just run the "what" command on the executable. It tells you what version the program is, and most of the time, even tells you what version of the libraries were compiled into it.

I think you'll probably be fine, and that this is pretty recoverable, and your servers aren't probably in any danger, especially if commands were merely copied to /etc, and not moved.

Good Luck!

[Steven E. Protter]

Shalom RayB,

No executable files in my /etc, as Pete said symbolic links, which is not the same thing.

SEP

[James R. Ferguson · Accepted solution]

Hi Ray:

Pete is correct. What you see are symbolic links to the executables in '/usr/sbin'. If you do an 'ls -l' you will clearly see this.

Prior to 10.0, the '/etc' directory did hold executables. This changed in HP-UX at that point when the filesystem layout was revamped:

http://docs.hp.com/en/5963-8942/5963-8942.pdf

Since these are symbolic links they don't cause any harm. Leave things alone.

You can also see that the sticky bit is set on these links:

lr-sr-xr-t 1 root sys 19 Mar 3 14:22 /etc/vgdisplay -> /usr/sbin/vgdisplay

This further tells you that these are the "t(ransition)" links discussed in the aforementioned document.

Regards!

...JRF...

[Raynald Boucher]

You are right.
There no actual executables and they are all symbolic links.

We are running 11.11.
Is there any benefit or danger to removing them besides avoiding future confusion?

Thanks again RayB

[James R. Ferguson]

Hi (again) Ray:

> Is there any benefit or danger to removing them besides avoiding future confusion?

There is no benefit in removing them.

If you do, you run a remote (?) risk that some software may reference the link in lieu of the executable directly. In that case the software would not behave as expected.

Since you are now enlightened, what possible "future confusion" would there be?!?

Regards!

...JRF...

[Pete Randall]

I doubt removing them would do you any good, because they will come back the next time you install a patch. The last steps of swinstall re-create the transition links IIRC, a wasted step that could well be eliminated.


Pete

[James R. Ferguson]

Hi (again):

Oh, and since they are transition links, as I noted, the next installation of software that causes 'tlinstall' to run will put them back again!

Regards!

...JRF...

[TTr]

> Is there any benefit or danger to removing them besides avoiding future confusion?

benefit? no (well you'll be saving some file entries and space in your filesystem which is minimal)

danger? maybe. If HP did not remove them I would not remove them either. There is always the possibility that burried somewhere else in the system one of these commands is reffered to by the /etc/ path as opposed to by the /usr/sbin path. HP were saying that these would be removed at 11.00 but they waited until 11.31.

[Raynald Boucher]

Good,
I will leave things as they are.

Thanks again.

RayB

[Dennis Handly]

>It is safe to delete them from /etc?

This will just upset swverify. ;-)

>TwoProc: /etc/profile, and that is a script - not a program.

Actually it doesn't have to be executable since it is sourced by the shell.

>JRF: You can also see that the sticky bit is set on these links:

Tlinks are replaced by regular symlinks on 11.31.

[Dennis Handly]

>TTr: HP were saying that these would be removed at 11.00 but they waited until 11.31.

No, on 11.31, they made them permanent, with only a few removed.