NOTE: This is on a Redhat ES 2.1 Server

I am very, very confused. The file is a ColdFusion file in /home/httpd/www. I have permissions to edit the file.

[root@www www]# ls -lah Stuff.cfm
-rw-rw-r-- 1 mike mike 7.4k Jul 23 15:31 Stuff.cfm

The file system is also mounted as read-write.

[root@www www]# mount
/dev/cciss/c0d0p9 on / type ext3 (rw)
none on /proc type proc (rw)
usbdevfs on /proc/bus/usb type usbdevfs (rw)
/dev/cciss/c0d0p1 on /boot type ext3 (rw)
none on /dev/pts type devpts (rw,gid=5,mode=620)
/dev/cciss/c0d0p5 on /home type ext3 (rw)
/dev/cciss/c0d0p2 on /home/httpd type ext3 (rw)
/dev/cciss/c0d0p8 on /opt type ext3 (rw)
/dev/cciss/c0d0p10 on /tmp type ext3 (rw)
/dev/cciss/c0d0p3 on /usr type ext3 (rw)
/dev/cciss/c0d0p7 on /var type ext3 (rw)

But I can't edit the file, when I open and do an insert operation in vi I get:
-- INSERT -- W10: Warning: Changing a readonly file

And when I try to save the file anyways with wq! I get:
"Stuff.cfm" E212: Can't open file for writing
Hit ENTER or type command to continue

Any clue what in the hell is going on? I didn't set this system up, I've inherited it. After some testing I've found that /etc/passwd and /etc/shadow do the same exact thing, even though I can edit them with root on seperate installations. Can't edit with PICO either. Hell, I can't even chmod the file:
[root@www www]# chmod +w ProgViewFundingOps.cfm
chmod: changing permissions of `ProgViewFundingOps.cfm': Operation not permitted

You are logged in as root, not as mike. That file is writeable only by user or group 'mike', not 'root.
-------------------------------------
Sorry, too hasty. root can edit any file, I then have no clue as to what is causing this.

Yeah I know root can edit any file which is why I was really confused, but I found the problem. The file was using "chattr" as a secondary file system to place a lock on the file. The file was set to immutable.

[root@www www]# lsattr Stuff.cfm
---i---------- Stuff.cfm

So I tried to change it using chattr, but it didn't work.

[root@www www]# chattr -i Stuff.cfm
[root@www www]# lsattr Stuff.cfm
---i---------- Stuff.cfm

I then went and checked the history of the various accounts (I inherited this box so I was looking for a clue) and found the cr command, which may be a custom command for Redhat ES 2.1 or may be something that the administrator built in to prevent someone from knowing how to properly change the file attributes.

[root@www www]# cr -i Stuff.cfm
[root@www www]# lsattr Stuff.cfm
-------------- Stuff.cfm

The file was then editable. To put back the immutable status I used chattr, though cr also worked for some reason. Again, I suspect this was obfuscation on the part of the admin.

[root@www www]# cr +i Stuff.cfm
[root@www www]# lsattr Stuff.cfm
---i---------- Stuff.cfm
[root@www www]# cr -i Stuff.cfm
[root@www www]# chattr +i Stuff.cfm
[root@www www]# lsattr Stuff.cfm
---i---------- Stuff.cfm

So now everyone is happy. Once I removed immutable from the file I was able to edit it fine. Thanks for your help, and I hope this helps someone else.

it already started helping people!!

thanks!!

=)


by the way, i'm a little curious about why you haven't made your own install, as every linux user i know would be way too paranoid as to actually trust someone else's install...

have you checked the install for rootkits??

http://www.rootkit.nl

=)

I'm just admin-ing this box for him while he's on vacation, but couldn't get in touch with him to find out what he had done.

Rest assured if it was MY box it would be running Debian .

I'm glad it helped. I couldn't find ANYTHING on this for like two days on Google, which is why I thought it would be a good idea to post a detailed account of what I had found.