From owner-freebsd-security Tue Jul 23 1: 5: 7 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2B5CC37B400 for ; Tue, 23 Jul 2002 01:05:04 -0700 (PDT) Received: from mail.fpsn.net (mail.fpsn.net [63.224.69.57]) by mx1.FreeBSD.org (Postfix) with ESMTP id 648C843E4A for ; Tue, 23 Jul 2002 01:05:03 -0700 (PDT) (envelope-from cfaber@fpsn.net) Received: from fpsn.net (unixgr.com [63.224.69.60]) (authenticated) by mail.fpsn.net (8.11.6/8.11.6) with ESMTP id g6N84di61709; Tue, 23 Jul 2002 02:04:40 -0600 (MDT) Message-ID: <3D3D0E05.B966A72D@fpsn.net> Date: Tue, 23 Jul 2002 02:04:21 -0600 From: Colin Faber Organization: fpsn.net, Inc. (http://www.fpsn.net) X-Mailer: Mozilla 4.78 [en] (Windows NT 5.0; U) X-Accept-Language: en MIME-Version: 1.0 To: Evren Yurtesen Cc: Brett Glass , security@FreeBSD.ORG Subject: Re: "Text file busy" References: <20020723103201.M86108-100000@finland.ispro.net.tr> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Common cause: Samba Normally you'll see this when you've got someone hacking up a file with something like wordpad etc. Which may set the lock but fails to remove it, thus samba keeps the lock in tact and you receive that error. Evren Yurtesen wrote: > > if a program is running and locked the file. > I believe you can see which file is open by which process > with fstat command > > On Tue, 23 Jul 2002, Brett Glass wrote: > > > A FreeBSD server belonging to a client of mine has begun to report "Text > > file busy" in response to common commands. I can't see anything unusual > > on the surface, but am concerned that the server may have been > > compromised anyway (a rootkit could have been installed) and that this is > > a symptom. What mechanism generates this message? And does it suggest > > that the machine may have been rooted? > > > > --Brett Glass > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > > with "unsubscribe freebsd-security" in the body of the message > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-security" in the body of the message -- Colin Faber (303) 736-5160 fpsn.net, Inc. * Black holes are where God divided by zero. * To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message