UID change without request

piiwhy · 05-30-2012, 08:07 AM

Hello,

I'm not sure this is the right section to post...

On a computer I'm not responsable of, UID for a file seems to have changed without any request.

The new UID is not linked to a known user

Code:

cat /etc/passwd

The new id is only one bit different from previous one :
from 0 to 1073741824 => 1000000000000000000000000000000

Is it possible that a hardware issue modified this ?

Thank you,

P?

Kustom42 · 05-30-2012, 03:47 PM

Doubtful that hardware corrupted it, possibly file system corruption but I've never heard of an inode just changing the UID. sounds more like it was changed through something done on the machine itself, either a program running or a user modifying it.

piiwhy · 06-04-2012, 03:40 AM

Hi,

Thanks for the response,

I did not find any soft/utilitie/script able to change user.

Another point which makes me think about hardware issue is that destination UID is not linked to a known user.

P?

rknichols · 06-04-2012, 08:19 AM

It's easy enough (as root) to set the file ownership to any numeric UID.

Code:

# touch /tmp/junk
# chown 1073741824 /tmp/junk
# ls -l /tmp/junk
-rw-r--r--. 1 1073741824 root 0 2012-06-04 08:14 /tmp/junk
# chown 5551212 /tmp/junk
# ls -l /tmp/junk
-rw-r--r--. 1 5551212 root 0 2012-06-04 08:14 /tmp/junk

piiwhy · 06-04-2012, 11:40 AM

Hello rknichols,

The point was not to find a way to change UID but to find the way it was changed.

In my case, the server is not touched by any administrator and i did not find any auto scripts on configuration able to change the UID which could explain the modification.

That's why i emit the hypothesis the UID was changed by drive issue.

rknichols · 06-04-2012, 02:32 PM

I was responding to your statements:

Quote:

Originally Posted by piiwhy

I did not find any soft/utilitie/script able to change user.

Another point which makes me think about hardware issue is that destination UID is not linked to a known user.

which implied that you did not know what program could change the owning UID and that a UID that did not map to any user name somehow suggested a hardware fault.

Kustom42 · 06-08-2012, 02:34 PM

I bounced this off a few people and nobody I spoke with could think of any possible way a hardware fault could cause the uid of a file to be modified. I think you are on the wrong track here, it was done on the OS level either by a user or by another program.