Re: "Text file busy"

From: Brian W. Buchanan (brian@CSUA.Berkeley.EDU)
Date: 07/23/02 

Date: Mon, 22 Jul 2002 23:55:01 -0700 (PDT)
From: "Brian W. Buchanan" <brian@CSUA.Berkeley.EDU>
To: Brett Glass <brett@lariat.org>

It's possible that a rootkit is trying to write to a file when someone
runs a command, but this file happens to actually be the text of a running
process. Or maybe the shell's history file has somehow become the text of
a running process.

The only other thing I can find that would cause the error is that
execve will return ETXTBSY if someone has the file open for writing.

I advise investigating the output of ps and fstat, or better yet,
ktraceing the shell.

- Brian

On Tue, 23 Jul 2002, Brett Glass wrote:

> A FreeBSD server belonging to a client of mine has begun to report "Text
> file busy" in response to common commands. I can't see anything unusual
> on the surface, but am concerned that the server may have been
> compromised anyway (a rootkit could have been installed) and that this is
> a symptom. What mechanism generates this message? And does it suggest
> that the machine may have been rooted?
>
> --Brett Glass
>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages