On 2004-03-21, Anthony Campbell <[EMAIL PROTECTED]> wrote: > On 21 Mar 2004, Anthony Campbell wrote: >> For some time there have been errors processing procps. Using aptitude I'm getting: >> -------------------------- >> (Reading database ... 82789 files and directories currently installed.) >> Preparing to replace procps 1:3.1.14-1 (using .../procps_1%3a3.2.0-1_i386.deb) ... >> Unpacking replacement procps ... >> dpkg: error processing /var/cache/apt/archives/procps_1%3a3.2.0-1_i386.deb >> (--unpack): >> unable to make backup link of `./bin/ps' before installing new version: Operation >> not permitted >> dpkg-deb: subprocess paste killed by signal (Broken pipe) >> Setting kernel variables.net.ipv4.tcp_ecn = 0 >> >> Errors were encountered while processing: >> /var/cache/apt/archives/procps_1%3a3.2.0-1_i386.deb >> E: Sub-process /usr/bin/dpkg returned an error code (1) >> Ack! Something bad happened while installing packages. Trying to recover: >> Press return to continue. >> ------------------------------- >> >> Anyone know what is happening here? This on testing, kernel 2.4.24. >> > > Using lsattr I finally discovered that the "i" attribute had been set on > /bin/ps. I've no idea how this happened but removing it with chattr -i > made everything work again. > > AC >
Please install and run chkrootkit. I can't imagine why /bin/ps would have the i attribute set if you don't remember it - you may have been rooted. -- I usually have a GPG digital signature included as an attachment. See http://www.gnupg.org/ for info about these digital signatures. My key was last signed 10/14/2003. If you use GPG *please* see me about signing the key. ***** My computer can't give you viruses by email. *** -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
