uid, gid don't exist, yet files owned by them, i need to delete them
 

hi,
please excuse my English.
I have a file, "wackyfile", owned by some crazy uid/gid that doesn't exist, and I want to remove it. It is local:

%ls -al
d--xr-x--x 2 8150884 13459827 49152 Feb 13 1971 wackyfile

I have no idea how the user/file got created. I have never had a user with that UID. But we are in an NFS environment, and I have see crazy stuff before.
-
As root, when I try to delete them, I get "permission denied" :

% rm -rf wackyfile/
rm: cannot open directory `wackyfile/.': Permission denied
rm: cannot remove directory `wackyfile': Operation not permitted

-
So I think, the permissions are bad (before it tries to remove, it tries to open, but can't. So the first step is just to chmod it! but as root, I can't change the permissions with chmod.

So what I did, was create a local user in /etc/passwd and /etc/group, with the corresponding uid/gid, "gooduser"

$ ls -al
d--xr-x--x 2 gooduser gooduser 49152 Feb 13 1971 wackyfile

--
Ah. Not to crazy looking now! But I still can't rm this stuff:

$ whoami
gooduser

$ rm -rf wackyfile/
rm: cannot open directory `wackyfile/.': Permission denied
rm: cannot remove directory `wackyfile': Operation not permitted
-
What's going on? I'd appreciate any pointers to tools that can tell me deeper information about this file.

thanks,
mattie

according to your transcript, you didn't chmod it with the new user either.

$ whoami
gooduser
$ chmod 0777 wackyfile
$ rm -rf wackyfile

hth --Jonas

Hi Jonas. thanks for the reply.
(sorry, I meant to say that I tried chmod, too)

$ whoami
gooduser

$ chmod 0777 wackyfile
chmod: changing permissions of `wackyfile': Operation not permitted

mattie

You forgot to mention whether wackyfile is on a local
or remote file-system ...

Hi there Tinkster. Good question. It is local.
mattie

File-system, mount options, ... ?

If you run ext2 try
$ lsattr wackyfile
If you see something other than ------------- this means that the file attributes are messed. One of them was (i) data journaling, which doesn't permit the file to be renamed ot deleted. You could see man chattr.

Ivanatora,
OK, I think your tip has gotten me on the right track! When I run "lsattr" I get nothing back! So the file attributes are messed up! I looked at chattr's man, ran chattr -i on "wackyfile" and still can't remove. I will do some googling on chattr/lsattr, and follow up. Hopefully I'm close!
mattie

RESOLVED!
I ran:
$ chattr -ai wackyfile
and then *was* able to rm successfully.

The man page was difficult for me to understand. They mention each attribute (a,i, etc) but don't describe them as arguments really, those attributes are buried in paragraphs, as opposed to being set along the edge of the man page, in a column.

thanks to everybody to responded, it's so generous of you!

mattie

I'm glad you've found the answer :)

Technically, to the kernel that is a file, however, to us humans, it's a directory
d--xr-x--x 2 8150884 13459827 49152 Feb 13 1971 wackyfile

If this is a partition that is world writable, you might look for other similar directories.
You system may perform periodic checks for unowned files and directories.

Also, sometimes a file will be difficult to delete because of the characters chosen 'such as '-- filename'. In such a case, try the unlink command. It uses a different function and may work where rm fails.