On 21 Mar 2004, Ken Bloom wrote: > On 2004-03-21, Anthony Campbell <[EMAIL PROTECTED]> wrote: > > On 21 Mar 2004, Anthony Campbell wrote: > >> For some time there have been errors processing procps. Using aptitude I'm > >> getting: > >> -------------------------- > >> (Reading database ... 82789 files and directories currently installed.) > >> Preparing to replace procps 1:3.1.14-1 (using .../procps_1%3a3.2.0-1_i386.deb) ... > >> Unpacking replacement procps ... > >> dpkg: error processing /var/cache/apt/archives/procps_1%3a3.2.0-1_i386.deb > >> (--unpack): > >> unable to make backup link of `./bin/ps' before installing new version: > >> Operation not permitted > >> dpkg-deb: subprocess paste killed by signal (Broken pipe) > >> Setting kernel variables.net.ipv4.tcp_ecn = 0 > >> > >> Errors were encountered while processing: > >> /var/cache/apt/archives/procps_1%3a3.2.0-1_i386.deb > >> E: Sub-process /usr/bin/dpkg returned an error code (1) > >> Ack! Something bad happened while installing packages. Trying to recover: > >> Press return to continue. > >> ------------------------------- > >> > >> Anyone know what is happening here? This on testing, kernel 2.4.24. > >> > > > > Using lsattr I finally discovered that the "i" attribute had been set on > > /bin/ps. I've no idea how this happened but removing it with chattr -i > > made everything work again. > > > > AC > > > > Please install and run chkrootkit. I can't imagine why /bin/ps would > have the i attribute set if you don't remember it - you may have been > rooted. >
Thanks for this pointer. However, chkrootkit does not show anything amiss. AC -- [EMAIL PROTECTED] || http://www.acampbell.org.uk using Linux GNU/Debian || for book reviews, electronic Windows-free zone || books and skeptical articles -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
