Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 29 Jan 2006 00:07:29 -0800
From:      Julian Elischer <julian@elischer.org>
To:        Peter Jeremy <peterjeremy@optushome.com.au>
Cc:        current@freebsd.org
Subject:   Re: Unreferenced files not being deleted
Message-ID:  <43DC77C1.8060308@elischer.org>
In-Reply-To: <20060128134625.GA2384@turion.vk2pj.dyndns.org>
References:  <20060126195647.GA2559@turion.vk2pj.dyndns.org> <20060128134625.GA2384@turion.vk2pj.dyndns.org>

next in thread | previous in thread | raw e-mail | index | archive | help
Peter Jeremy wrote:

>On Fri, 2006-Jan-27 06:56:47 +1100, Peter Jeremy wrote:
>  
>
>>On my recent -current, I've noticed that /var is filling up with
>>unreferenced files.
>>    
>>
>
>Updated data point:  The files do disappear on a clean shutdown
>so the kernel seems to be aware that they have no name but
>neither fstat nor lsof can find any processes holding them open.
>I have a core dump demonstrating the problem and will poke around
>in it as a background task.
>
>  
>
You know it occured to me that a process that is not in the process list 
would still work..

could be an easy way to effect a rootkit if one had root access.
wouldn't show up in ps, fstat etc.

it could be another answer to your mystery.. :-/





Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?43DC77C1.8060308>