For a couple of (boring) reasons, I've got Firefox 3.5 and 3.6 installed on a Ubuntu 9.04 machine.

In /usr/bin, there are these symbolic links:
/usr/bin/firefox -> firefox-3.5
/usr/bin/firefox-3.5 -> ../lib/firefox-3.5.8pre/firefox.sh
/usr/bin/firefox-3.6 -> ../lib/firefox-3.6b4/firefox

That is what it looks like after boot. I need to change the firefox link to firefox-3.6 (so I have /usr/bin/firefox -> firefox-3.6 ). I've done that, and it all works fine.

Then I reboot, and my change vanishes.

My problem is not that it happens, but that I have no idea what is doing it. There's nothing in /etc/init.d I can blame, cron is not doing it, and I've even searched all the files under /etc for anything that might tell me something, and I cannot find it.

I don't even need to know a full "fix", I just want to know what the application/script/process is, so I can look it up and think about changing it.

Any ideas of what I should be looking at?

If you use KDE (or Gnome, for all I know) there exists a ~/.kde4 directory for every user. You might investigate there or just create a new user and try the link-magic from there.

And then, did you check the access settings for all those files and symbolic links, are they maybe root's and you're forbidden to touch them ?

0 members found this post helpful.

That is true, I could override the behaviour easily with a user specific link that occurs earlier in the path for the user. But that's not really the question - I need to know what is changing the links.

The links are owned by root, as are most things in /usr/bin. I don't want to change that (and I have to be root to repair the damage being done by the unknown process - access is not the problem)

What I meant is that the links might automatically revert to the original state after boot. What happens if a normal user creates a link exactly like root in the same directory? Dead links? What says "ls -la" in that directory?

Yes, that is exactly the question - what is causing the links to change when I reboot?

Nothing - it's /usr/bin, so a normal user does not have any permissions. Root can change the links of course, no problem.

ls -la shows no hidden files.

Is this a virtual machine?

No, physical, but that's irrelevant - it is part of the boot process that is overwriting the links. The links are fine if I stop the machine and mount the root disk on another box, they change on start up.

I do have a VM - ubuntu 9.04, off the shelf, plus standard packages, plus Firefox 3.6 and my links as above. It is doing exactly the same thing.

Long shot: Try the file system tools like "dump2fs" whether there remain traces ... umm, no, you'd find the corpse but not the perpetrator of the deed. Why not "chmod 000 /usr/bin/firefox -> firefox-3.6" and after booting look for errors or warnings in "dmesg"'s output?

Nice idea - try to force it to fall over.

Just tried it, nothing in dmesg, and the links were replaced again, with normal permissions. Whatever is doing it is definitelydoing it as root.

Grrr. Did you look into the logs as well? Just to be on the secure sideRootkit?

<edit> Oh yes, do you have ACL enabled? "man getfacl"... </edit>

@OP
It looks like it's apparmor. Take a look at this for more details.

Regards