When I did a ls -alh |grep T under /usr/sbin, I found that some files with very strange sizes and permissions:

How come there is such a file with a size of 291T?!

Am I hacked? What is the cause of this problem?

I don't have an answer for what happened but it looks like those files are foobarred beyond belief. Or your filesystem itself has been corrupted.

Easy solution: Delete or un-install the package those files came from and re-install that program. Then check to see if permissions and sizes are sane.

If not --
Pain in the A** solution:
N.B. I can't tell you if this will help or not but it can't hurt and I don't have any other ideas.

Is /usr or /usr/sbin on a separate partition? You could umount that partition, fsck it and see what happens.

If not a separate partition, you could force an fsck by placing a file named forcefsck in the /etc directory and reboot.

You do not want to run fsck on mounted file systems.

If that works, remove the /etc/forcefsck file.

Hopefully, all you need is a fresh install of that particular package. You might considered downloading the latest version from your distro in case say your CD install disc has a corrupted package.

Hacked? I doubt it.

Good Luck

Thanks for helping.

Here is what I did, I booted using another linux in the disk and fsck-ed the one causing trouble.

fsck did find some problems and fixed them. But when I booted back, the problems are still there. Ok, I once again booted to the rescue linux and did fsck again on that reiserfs partition. No problems found, clean. When I rechecked these files, they still got the riduculous sizes and permissions.

I am wondering what is causing this? Yes I can delete them and reinstall the pkgs but I want to know the reason. And why fsck couldn't correct them?

Could you also help with another question?
?-w-r-S--- 33261 root root 291T 2006-05-18 23:43 exim_convert4r4

what does the S in capital letter mean? (uncapitalized letter s means sticky, that I know) and what about the firt question mark in the same line above?

An exact reason, I don't know, sorry.

The ? means ls can't tell what kind of file it is because it's hosed.

Actually 't' means that the sticky bit has been set. 's' is the setuid or setgroupid bit. I can't find anything in the info manual indicating a capital S as a file permission bit.

Hope you get it sorted it out.

Hi phyrster,


[root@shakti]# ls -l
-rwSr-Sr-T 1 root root 0 May 29 18:06 y

S is for SUID and T is for sticky bit don't get afraid
they are not harmful as you might have thought

Try this and you will know why:-

touch y
ls -l y
chmod +t y
ls -l y
chmod +s y
ls -l y


Also check out some tutorials on chmod and chattr


Hope, this will help you

Thanks. The question is why there is a captilized S and uncapitalized s ?

any difference between them? Also what does the ? mean in the lines quoted in the first posting?

Upper case S is SGID bit and lower case s is SUID.

Regards
Manjunath