Cannot rm or chown /var/log/snort as root

OtagoHarbour · 05-19-2013, 07:02 PM

I am using Ubuntu 11.10 Gnome.

I installed an older version of Snort, uninstalled it and tried to install the latest version as root using sudo. However, the install crashed because root does not have permission to change or remove /var/log/snort. I thought root was supposed to have permuission to do anything. At least it should IMO.

Code:

ls -ld /var/log/snort

returns

Code:

drwxr-s--- 2 snort adm 4096 2013-05-16 21:17 /var/log/snort

Can anyone suggest a resolution to this problem.

Thanks,
Peter.

widget · 05-19-2013, 08:26 PM

Well I have a couple suggestions but no solution to offer.

Post this in the Ubuntu section of LQ.
http://www.linuxquestions.org/questions/ubuntu-63/

Because while a respin of Debian they do some "interesting" things to the file system.

You might want to try;

Code:

sudo su

to get to the # prompt.

You are using a version of Ubuntu that is no longer supported and should probably consider a more current version. 12.04 is an LTS release.

You could open your file manager as root and navigate to the file and try Shift + Delete keys.

Did you cd to /var before running the rm command?

OtagoHarbour · 05-19-2013, 08:45 PM

Quote:

Originally Posted by widget

Well I have a couple suggestions but no solution to offer.

Post this in the Ubuntu section of LQ.
http://www.linuxquestions.org/questions/ubuntu-63/

Because while a respin of Debian they do some "interesting" things to the file system.

You might want to try;

Code:

sudo su

to get to the # prompt.

You are using a version of Ubuntu that is no longer supported and should probably consider a more current version. 12.04 is an LTS release.

You could open your file manager as root and navigate to the file and try Shift + Delete keys.

Did you cd to /var before running the rm command?

I did

Code:

sudo su
cd /var/log
rm -r snort

This resulted in

Code:

rm: cannot remove `snort/tcpdump.log.1362660537': Operation not permitted
rm: cannot remove `snort/alert.1.gz': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1365997593': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1361795972': Operation not permitted
rm: cannot remove `snort/alert.2.gz': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1361624018': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1365638373': Operation not permitted
rm: cannot remove `snort/alert.5.gz': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1365642298': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1362315310': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1363003251': Operation not permitted
rm: cannot remove `snort/alert.6.gz': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1365647668': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1362916365': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1365643063': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1361709620': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1362141686': Operation not permitted
rm: cannot remove `snort/alert.4.gz': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1361883741': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1361537869': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1365642397': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1362747549': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1362055135': Operation not permitted
rm: cannot remove `snort/alert': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1362227876': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1368753466': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1361969023': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1365642556': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1362834052': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1362487641': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1362401008': Operation not permitted
rm: cannot remove `snort/alert.7.gz': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1362160978': Operation not permitted
rm: cannot remove `snort/alert.3.gz': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1365643615': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1362574709': Operation not permitted
rm: cannot remove `snort/tcpdump.log.1365645774': Operation not permitted

I tried shift-<del> in file manager as root and got the message

Code:

Error removing file: operation not permitted.

I have not upgraded since I had a lot of problems with Unity which I have never had with Gnome.

Thanks,
Peter.

dayid · 05-19-2013, 09:41 PM

This may not be the issue, but to be sure, check the attributes of the files/directory you are experiencing trouble with:

Code:

lsattr FILE

You can use chattr(1) to modify attributes.

See the chattr manpage for more information about attributes. I'd bet that it has the immutable attribute set and that is what is preventing root from removing it.

OtagoHarbour · 05-20-2013, 07:19 PM

Quote:

Originally Posted by dayid

This may not be the issue, but to be sure, check the attributes of the files/directory you are experiencing trouble with:

Code:

lsattr FILE

You can use chattr(1) to modify attributes.

See the chattr manpage for more information about attributes. I'd bet that it has the immutable attribute set and that is what is preventing root from removing it.

Thank you for your reply. I used lsattr and the one thing that /var/log/snort, and all of its contents have in common is that they all have the e bit set. I tried

Code:

sudo chattr -e snort

and got the error message

Code:

Clearing extent flag not supported on snort

I got the same message when I tried

Code:

sudo chattr -e snort/*

dayid · 05-20-2013, 07:21 PM

Quote:

Originally Posted by OtagoHarbour

I used lsattr and the one thing that /var/log/snort, and all of its contents have in common is that they all have the e bit set.

...That's normal

Quote:

Originally Posted by chattr(1) manpage

The 'e' attribute indicates that the file is using extents for mapping the blocks on disk. It may not be removed using chattr(1).

Guess I was wrong about having the immutable - not sure what your issue is then.

Dutch Master · 05-20-2013, 07:51 PM

For removing directories forcefully, use the -f option of rm.

Code:

sudo rm -rf /var/log/snort

Other commands to investigate what's wrong:

Code:

lsof | grep snort
ls -al /var/log | grep snort

However, I concur that upgrading your Ubuntu, or even switching to a different distro, is the preferred option...

OtagoHarbour · 05-20-2013, 08:16 PM

Quote:

Originally Posted by Dutch Master

For removing directories forcefully, use the -f option of rm.

Code:

sudo rm -rf /var/log/snort

Other commands to investigate what's wrong:

Code:

lsof | grep snort
ls -al /var/log | grep snort

However, I concur that upgrading your Ubuntu, or even switching to a different distro, is the preferred option...

Unfortunately

Code:

sudo rm -rf /var/log/snort

did not work, even after rebooting and going into restore mode. I think I will look into replacing Ubuntu with a different OS. Can you recommend a free Linux or Unix distro that does not have this problem?

Thanks,
Peter.

OtagoHarbour · 05-20-2013, 08:34 PM

Quote:

Originally Posted by Dutch Master

For removing directories forcefully, use the -f option of rm.

Code:

sudo rm -rf /var/log/snort

Other commands to investigate what's wrong:

Code:

lsof | grep snort
ls -al /var/log | grep snort

However, I concur that upgrading your Ubuntu, or even switching to a different distro, is the preferred option...

I used

Code:

getent group adm

and found that my regular user name is a member of that group, which owns /var/log/snort and its contents but I still cannot do

Code:

rm -rf /var/log/snort

Thanks,
Peter.

OtagoHarbour · 05-20-2013, 10:28 PM

Quote:

Originally Posted by dayid

...That's normal

Guess I was wrong about having the immutable - not sure what your issue is then.

Code:

sudo chattr -i snort/*

enabled me to remove the contents of /var/log/snort although the i attribute did not appear to have been set.

However

Code:

sudo chattr -i snort

did not allow me to remove /var/log/snort itself.

unSpawn · 05-22-2013, 01:47 AM

Probably due to a combination of not using that particular Linux distributions features like they would like to see you do ('sudo rm -rf /var/log/snort'), plus providing incomplete information plus not getting the "right" information what you have effectively done is cross-posting your issues on the topic across three (see here and here) if not more threads. That is neither acceptable or efficient.

Please post your thread in only one forum. Posting a single thread in the most relevant forum will make it easier for members to help you and will keep the discussion in one place. This thread is being closed as a duplicate of http://www.linuxquestions.org/questi...ed-4175462943/.