Altered /dev/null

Top Page
Attachments:
Message as email
+ (text/plain)
Delete this message
Reply to this message
Author: Eric \"Shubes\"
Date:  
To: PLUG-discuss
Subject: Altered /dev/null
Hey, y'all (moin?)
Good to be here (or heard).

Yesterday was not a good day for computers. Today is much better. (Just
my own meaningless observation)

Here's the nuts-n-bolts. I have a Dell PE450sc that's been running RHL9
for nearly two months without a hitch. It services a small business that
constists of Win9x/Xp workstations, and I was in the process of
installing a Fedora Core 1 boxen to replace one of the Win9x
workstations. Somewhere along the line, /dev/null was altered on the
server. I haven't verified yet (I'm off site), but it appears that
/dev/null at some point became read-only. I don't know what its current
attributes are, so the read-only could be an attribute of the file, or
an attribute of the mount. Doesn't matter. To fix it, I plan on booting
from a recovery media (linux recover), then remove and recreate
/dev/null (mknod -m 666 /dev/null c 1 3). I'm confident that this will
fix the problem.

I also plan on adding a simple bit of code to /etc/rc.d/rc.sysinit to
check the integrity of /dev/null (is it a character device with r/w
permissions?) before trying to mount the /proc file system. Needless to
say, "mount -n -t proc /proc /proc" freaks out when /dev/null isn't what
it's expected to be (a character device with rw permissions). Let alone
various subsequent errors that occur in rc.sysinit because there's no
"/proc" mounted after the mount command fails. One might think that (at
least) an error code check (in rc.sysinit, after mount /proc) would be
prudent. None there, at least not on RH9. I doubt that there's any error
checking on debian either, and I'm sure I'll hear of it if I'm wrong. ;)

I'll save posting the script change until I've tested it (a dozen or so
lines of script). In the meantime, I'm interested in comments about:
1) how /dev/null can have its attributes (file descriptor, ro/rw)
changed (of course the offending program would have to be run as root -
something else?)
2) has anyone else had to remove and mknod /dev/null manually?
3) what does anyone know about /dev/null vs. /dev/zero (they could be
linked, no?)

Well, that should start some things going.
I'm ready for any flares, though I hope they'll be few.

P.S. When was the last time you used the scroll-lock key to scroll-lock?
(not for KVM) I'm glad I didn't post that question here. I actually
remembered something on my own. ;)

--
-Eric 'shubes'



---------------------------------------------------
PLUG-discuss mailing list -
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss