On 7/22/12, Michael Schwendt mschwendt@gmail.com wrote:
Did the user run ktorrent as "root"?
No
encryption, scripts were enabled in ktorrent.
Also, did you keep a copy of the full "stat /usr" output? If not, why not?
(I did not have enough time to check much)
modify to /usr was on 19th July 3:00 hrs ( +5:30) change was same Access was 2 hours later.
ls -idZ output looked like
drwxrwxrwx. root root system_u:object_r:bin_t:s0 /usr/bin drwxrwxrwx. root root system_u:object_r:usr_t:s0 /usr/ drwxrwxrwx. root root system_u:object_r:usr_t:s0 /usr/share dr-xr-xr-x. root root system_u:object_r:bin_t:s0 /usr/sbin lrwxrwxrwx. root root system_u:object_r:bin_t:s0 /sbin -> usr/sbin
But /var was not writable by user.
Best
A. Mani