On 7/22/12, Michael Schwendt <mschwendt(a)gmail.com> wrote:
Did the user run ktorrent as "root"?
No
encryption, scripts were enabled in ktorrent.
Also, did you keep a copy of the full "stat /usr" output?
If not, why not?
(I did not have enough time to check much)
modify to /usr was on 19th July 3:00 hrs ( +5:30)
change was same
Access was 2 hours later.
ls -idZ output looked like
drwxrwxrwx. root root system_u:object_r:bin_t:s0 /usr/bin
drwxrwxrwx. root root system_u:object_r:usr_t:s0 /usr/
drwxrwxrwx. root root system_u:object_r:usr_t:s0 /usr/share
dr-xr-xr-x. root root system_u:object_r:bin_t:s0 /usr/sbin
lrwxrwxrwx. root root system_u:object_r:bin_t:s0 /sbin -> usr/sbin
But /var was not writable by user.
Best
A. Mani
--
A. Mani
CU, ASL, CLC, AMS, CMS
http://www.logicamani.in
http://www.logicamani.co.cc