rkhunter found this...
Daniel B. Thurman
dant at cdkkt.com
Fri Mar 27 02:07:31 UTC 2009
Daniel B. Thurman wrote:
> Mikkel L. Ellertson wrote:
>> Rick Stevens wrote:
>>> Do NOT ignore it. I don't think you quite understand what /dev/null
>>> is. It is supposed to be a device, not a file. Somehow it got deleted
>>> and now whenever a script or something does a redirect of its output to
>>> /dev/null, instead of going to a device (and thence into the bit
>>> bucket), it creates a file called /dev/null.
>> What the OP found was /dev/nul - one l. I suspect that /dev/null was
>> still there.
>>> To fix it:
>>> 1. Do an "ls -Z /dev/null" and make sure there is no _regular_ file,
>>> directory, symlink, pipe or anything else called "/dev/null". Check
>>> first character of the permissions. If it's anything other than a "c"
>>> then delete the file (you may need to do an "rm -rf /dev/null" to kill
>>> 2. As root, run "MAKEDEV -x null". That should recreate the device
>>> 3. Run "ls -Z /dev/null" again and you should see something like:
>>> crw-rw-rw- root root system_u:object_r:null_device_t:s0 /dev/null
>>> displayed. If the first character of the permissions is NOT a "c", it
>>> didn't work.
>> If he is running a fairly modern system - one that uses the dev file
>> system, and/or runs udev, then udev will re-create it when the
>> system reboots. In this case, it /dev/null is really gone, it is
>> probably the safest way for hte OP to fix it...
> Sigh. I should have pointed out that my /dev/null is a device (I knew
> it is unmolested!
> My device /dev/null IS as Mikkel said:
> crw-rw-rw- root root system_u:object_r:null_device_t:s0 /dev/null
> Instead, there is a TEXT file created: /dev/nul (one "l") and rkhunter
> reported it's suspicions correctly.
> I do NOT have any scripts that I have created (I only have
> TWO scripts in my home/bin and I looked with a fine-toothed
> comb. It is not ME that created the /dev/nul (one "l")
> Somewhere, the SYSTEM (script or program) is creating it.
> The "clue" I left was:
> # more /dev/nul
> nsdc: no patch necessary.
> For fun, I looked at: /etc/init.d/nsd and there was code
> in two places that had: 2>%1 (a stderr redirect?) and I suspected
> it was intended to be: 2>&1? I was not sure the % was
> something I have seen before - this does not exists in the
> entire /etc/init.d directory except for nsd! Bug????
I also found the same problems in:
There are three places where the same 2>%1 appears
but ALSO there is that /dev/nul (one "l") !!!
Now, the question I have is: is 2>%1 a valid redirect
string? If not, then it is only the cron script in 3 places
but if it is not, then there are 5 places, two in init.d and
three in the cron script.
More information about the users