File permission suddenly changed

daemonkl · 10-14-2007, 08:20 PM

I have changed the ownership of gcc and ld in /usr/bin to owner=root & group=wheel

Quote:

$ pwd
/usr/bin
$ ls -la gcc ld
-rwxr-x--x 1 root wheel 187176 Oct 12 17:52 gcc
-rwxr-x--x 1 root wheel 709236 Oct 12 17:52 ld

but in about one day later the file ownership has been changed to owner=root & group=compiler
also the file permission has been changed as below

Quote:

$ pwd
/usr/bin
$ ls -la gcc ld
-rwxr-x--- 2 root compiler 187176 Apr 21 03:54 gcc
-rwxr-x--- 1 root compiler 709236 Apr 21 03:54 ld

i have to change back the file permission and ownership to enable users running gcc and ld, but the same issue persist again the next day

what could be the possibilities and how do i make the changes i've made to the files are permanent

OS:
$ uname -a
FreeBSD server.mydomain.net 6.2-STABLE-JE FreeBSD 6.2-STABLE-JE #0: Sat Apr 21 01:07:18 UTC 2007 root@server:/usr/obj/usr/src/sys/GENERIC i386

thanks

matthewg42 · 10-14-2007, 09:16 PM

I notice that the date on the original version where group==compiler is newer than the date on the file which was present after the mysterious change in permissions.

My first guess is that some system upgrade or restore from backup replaced these files, setting the date and group in the process. To know how to prevent this happening in future, we must discover what caused the change.

You should check your system logs to see if there was an upgrade or restore from backup. If you are the sysadmin of the machine, you should know this already, if you are not, your best bet is to ask the sysadmin.

daemonkl · 10-14-2007, 09:26 PM

Quote:

Originally Posted by matthewg42

I notice that the date on the original version where group==compiler is newer than the date on the file which was present after the mysterious change in permissions.

My first guess is that some system upgrade or restore from backup replaced these files, setting the date and group in the process. To know how to prevent this happening in future, we must discover what caused the change.

You should check your system logs to see if there was an upgrade or restore from backup. If you are the sysadmin of the machine, you should know this already, if you are not, your best bet is to ask the sysadmin.

this is a pc with FreeBSD inside, and I did installation on this machine for testing at the same time allow several user's logging in to this machine
therefore, as far as I know i didn't do updating on this machine
how do I check the system logs to know what application is causing this issue?

daemonkl · 10-14-2007, 09:34 PM

which one should i check here?

Quote:

$ pwd
/var/log
$ ls -la
total 1846
drwxr-xr-x 4 root wheel 1536 Oct 15 05:00 .
drwxr-xr-x 25 root wheel 512 Oct 8 03:02 ..
-rw------- 1 root wheel 512709 Oct 15 05:20 auth.log
-rw------- 1 root wheel 42462 Oct 15 05:00 auth.log.0.bz2
-rw------- 1 root wheel 56961 Oct 15 04:00 auth.log.1.bz2
-rw------- 1 root wheel 18727 Oct 15 03:00 auth.log.2.bz2
-rw------- 1 root wheel 141753 Oct 15 02:00 auth.log.3.bz2
-rw------- 1 root wheel 233713 Oct 15 01:00 auth.log.4.bz2
-rw------- 1 root wheel 64729 Oct 15 00:00 auth.log.5.bz2
-rw------- 1 root wheel 40114 Oct 14 22:00 auth.log.6.bz2
-rw------- 1 root wheel 78690 Oct 14 21:00 auth.log.7.bz2
-rw-r--r-- 1 root wheel 0 Oct 2 22:45 checkphpv_error.log
-rw-r--r-- 1 root wheel 882 Oct 2 22:45 checkphpv_output.log
-rw-r--r-- 1 root wheel 228310 Oct 15 05:26 chkservd.log
-rw-r--r-- 1 root wheel 242 Oct 2 22:44 cpupdate.env
-rw------- 1 root wheel 81725 Oct 15 05:33 cron
-rw------- 1 root wheel 5240 Oct 14 12:00 cron.0.bz2
-rw------- 1 root wheel 5111 Oct 13 14:00 cron.1.bz2
-rw------- 1 root wheel 5117 Oct 12 16:00 cron.2.bz2
-rw------- 1 root wheel 5121 Oct 11 18:00 cron.3.bz2
drwx------ 18 root wheel 1024 Oct 15 05:30 dcpumon
-rw------- 1 root wheel 11342 Oct 15 03:04 debug.log
-rw-r--r-- 1 root wheel 5408 Oct 8 03:02 dmesg
-rw------- 1 root wheel 5741 Oct 13 10:01 dmesg.today
-rw------- 1 root wheel 5521 Oct 10 10:01 dmesg.yesterday
drwxr-xr-x 2 mailnull mail 512 Oct 2 05:07 exim
-rw-r--r-- 1 root wheel 29260 Oct 15 05:20 lastlog
-rw-r--r-- 1 root wheel 61 Sep 28 07:07 lpd-errs
-rw-r----- 1 root wheel 570 Oct 15 03:03 maillog
-rw-r----- 1 root wheel 1054 Oct 15 00:00 maillog.0.bz2
-rw-r----- 1 root wheel 1273 Oct 14 00:00 maillog.1.bz2
-rw-r----- 1 root wheel 1328 Oct 13 00:00 maillog.2.bz2
-rw-r----- 1 root wheel 1524 Oct 12 00:00 maillog.3.bz2
-rw-r----- 1 root wheel 1762 Oct 10 07:00 maillog.4.bz2
-rw-r----- 1 root wheel 1183 Oct 9 07:00 maillog.5.bz2
-rw-r----- 1 root wheel 1543 Oct 8 07:00 maillog.6.bz2
-rw-r----- 1 root wheel 1257 Oct 7 07:00 maillog.7.bz2
-rw-r--r-- 1 root wheel 48979 Oct 15 05:32 messages
-rw-r--r-- 1 root wheel 10217 Oct 8 14:00 messages.0.bz2
-rw-r--r-- 1 root wheel 10319 Oct 5 03:00 messages.1.bz2
-rw------- 1 root wheel 138 Oct 9 10:01 mount.today
-rw------- 1 root wheel 138 Oct 8 10:01 mount.yesterday
-rw------- 1 root wheel 0 Sep 28 10:01 pf.today
-rw-r----- 1 root network 61 Sep 28 07:07 ppp.log
-rw-r--r-- 1 root wheel 5432 Oct 8 03:44 restartsrv_err.log
-rw------- 1 root wheel 61 Sep 28 07:07 security
-rw-r----- 1 root wheel 0 Oct 12 01:00 sendmail.st
-rw-r----- 1 root wheel 0 Oct 12 00:00 sendmail.st.0
-rw-r----- 1 root wheel 0 Oct 5 01:00 sendmail.st.1
-rw-r----- 1 root wheel 0 Oct 5 00:00 sendmail.st.2
-rw-r----- 1 root wheel 0 Sep 28 01:00 sendmail.st.3
-rw-r----- 1 root wheel 0 Sep 28 00:00 sendmail.st.4
-rw-r----- 1 root wheel 0 Apr 21 03:56 sendmail.st.5
-rw------- 1 root wheel 6540 Oct 14 10:01 setuid.today
-rw------- 1 root wheel 6446 Oct 11 10:01 setuid.yesterday
-rw-r----- 1 root network 61 Sep 28 07:07 slip.log
-rw-r--r-- 1 root wheel 35112 Sep 27 23:53 stunnel-4.15-build.log
-rw------- 1 root wheel 14793 Oct 15 05:21 userlog
-rw-r--r-- 1 root wheel 25784 Oct 15 05:21 wtmp
-rw-r--r-- 1 root wheel 1496 Sep 30 14:47 wtmp.0
lrwxr-xr-x 1 root wheel 41 Sep 30 12:55 xferlog -> ../../usr/local/apache/domlogs/ftpxferlog
-rw-r--r-- 1 root wheel 2 Oct 14 12:56 xferlog.offset
-rw-r--r-- 1 root wheel 2 Oct 8 03:03 xferlog.offsetftpsep

Tinkster · 10-14-2007, 09:40 PM

Moved: This thread is more suitable in <*BSD> and has been moved accordingly to help your thread/question get the exposure it deserves.

hans51 · 10-15-2007, 12:47 AM

Quote:

Originally Posted by daemonkl

I have changed the ownership of gcc and ld in /usr/bin to owner=root & group=wheel

but in about one day later the file ownership has been changed to owner=root & group=compiler
also the file permission has been changed as below

i have to change back the file permission and ownership to enable users running gcc and ld, but the same issue persist again the next day

what could be the possibilities and how do i make the changes i've made to the files are permanent

OS:
$ uname -a
FreeBSD server.mydomain.net 6.2-STABLE-JE FreeBSD 6.2-STABLE-JE #0: Sat Apr 21 01:07:18 UTC 2007 root@server:/usr/obj/usr/src/sys/GENERIC i386

thanks

i am unfamiliar with BSD
BUT
in SuSE Linux we have a system routine for security verification at
/etc/permissions ( there are several security levels with variations of that above file name )
with that file on certain occasions the system restores the permissions according to the permissions set in that file.

check if you have such a file - and if yes, read when it is run by your system and change accordingly if you know exactly why you want different permissions than default.

anomie · 10-15-2007, 10:40 AM

Quote:

Originally Posted by daemonkl

but in about one day later the file ownership has been changed to owner=root & group=compiler
...
OS:
$ uname -a
FreeBSD server.mydomain.net 6.2-STABLE-JE FreeBSD 6.2-STABLE-JE #0: Sat Apr 21 01:07:18 UTC 2007 root@server:/usr/obj/usr/src/sys/GENERIC i386

This may be a good question for the freebsd-stable mailing list.

AFAIK, there is no compiler group on a FBSD RELEASE base installation. Did you install a port that added this?

daemonkl · 10-16-2007, 12:50 AM

Quote:

Originally Posted by anomie

This may be a good question for the freebsd-stable mailing list.

AFAIK, there is no compiler group on a FBSD RELEASE base installation. Did you install a port that added this?

i resolve this issue by making another copy of gcc and ld to /usr/sbin and chmod them to 511

and yes, the next day these files in /usr/bin keep changing the permission which is not allowing others to execute them

as far as I know, i didn't add any group named COMPILER
how do i check who is under COMPILER group then?

daemonkl · 10-16-2007, 01:18 AM

thanks...
i got it through pw to show whois under what group

Quote:

$ sudo pw groupshow compiler
compiler:*:1004:cpanel

now i found only one user which is cpanel under group: compiler
and yes, i got WHM cpanel running, what is going on with this cpanel until it need to change permission for gcc and ld?