From owner-freebsd-security Mon Jul 22 23:55:12 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 93D5F37B400 for ; Mon, 22 Jul 2002 23:55:10 -0700 (PDT) Received: from thought.holo.org (w120.z064002057.sjc-ca.dsl.cnc.net [64.2.57.120]) by mx1.FreeBSD.org (Postfix) with ESMTP id 27F5843E3B for ; Mon, 22 Jul 2002 23:55:10 -0700 (PDT) (envelope-from brian@CSUA.Berkeley.EDU) Received: from localhost (localhost [127.0.0.1]) by thought.int.holo.org (8.12.5/8.12.5) with ESMTP id g6N6t1jV065076; Mon, 22 Jul 2002 23:55:01 -0700 (PDT) (envelope-from brian@CSUA.Berkeley.EDU) Date: Mon, 22 Jul 2002 23:55:01 -0700 (PDT) From: "Brian W. Buchanan" X-X-Sender: brian@thought.int.holo.org To: Brett Glass Cc: security@FreeBSD.ORG Subject: Re: "Text file busy" In-Reply-To: <4.3.2.7.2.20020723002551.02245100@localhost> Message-ID: <20020722234752.E63571-100000@thought.int.holo.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org It's possible that a rootkit is trying to write to a file when someone runs a command, but this file happens to actually be the text of a running process. Or maybe the shell's history file has somehow become the text of a running process. The only other thing I can find that would cause the error is that execve will return ETXTBSY if someone has the file open for writing. I advise investigating the output of ps and fstat, or better yet, ktraceing the shell. - Brian On Tue, 23 Jul 2002, Brett Glass wrote: > A FreeBSD server belonging to a client of mine has begun to report "Text > file busy" in response to common commands. I can't see anything unusual > on the surface, but am concerned that the server may have been > compromised anyway (a rootkit could have been installed) and that this is > a symptom. What mechanism generates this message? And does it suggest > that the machine may have been rooted? > > --Brett Glass > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message