Re: root unable to delete

["Ryan W. Maple" <ryan@xxxxxxxxxxxxxxxxxxx>]

Mike,

> Can someone tell me how they did it ?

They may have modified the kernel, remounted the filesystem readonly... or
the may have simply set the immutable bit:


  ryan:~# touch this
  ryan:~# chattr +i this

  ryan:~# rm -f this
  rm: cannot remove `this': Operation not permitted

  ryan:~# lsattr this
  ----i---------- this

  ryan:~# chattr -i this
  ryan:~# rm this

see chattr(1) and lsattr(1) for more information.

Cheers,
Ryan


------------------------------------------------------------------------
     To unsubscribe email security-discuss-request@linuxsecurity.com
         with "unsubscribe" in the subject of the message.