[SOLVED] Home and some subdirectories have GID 9999 as owner group

TheEdgeOfRage · 2020-09-21 19:12:44

I have no idea when this happened, but I noticed that my home folder (/home/<user>) and the .gnupg and .ssh (but none of their subfolders and files) now have GID 9999 as the owner group.

There is no group with that GID in /etc/group, so I have no idea how and why this can happen. I don't recall ever running chown with 9999 on anything ever and checking my shell history of 40k lines also shows no signs of that happening.

I couldn't find anybody else having the same problem. I'd expect at least somebody to report it somewhere if it was a more widespread/common thing. I'm at a loss of what could have triggered this. For now I have set the owner back to my user's GID and see if it happens again.

Has anybody seen something like this before?

Last edited by TheEdgeOfRage (2020-09-22 11:19:13)

solskog · 2020-09-21 20:45:27

Pls check if you have any UID_MIN, UID_MAX, SYS_UID_MIN, SYS_UID_MAX set to 9999 inside /etc/login.defs.

TheEdgeOfRage · 2020-09-21 20:51:04

Nope, here are the values:

#
# Min/max values for automatic uid selection in useradd
#
UID_MIN			 1000
UID_MAX			60000
# System accounts
SYS_UID_MIN		  500
SYS_UID_MAX		  999

#
# Min/max values for automatic gid selection in groupadd
#
GID_MIN			 1000
GID_MAX			60000
# System accounts
SYS_GID_MIN		  500
SYS_GID_MAX		  999

seth · 2020-09-21 21:12:50

google thinks 9999 is the android UID for "nobody" - does that ring a bell?

TheEdgeOfRage · 2020-09-21 21:34:57

seth wrote:

google thinks 9999 is the android UID for "nobody" - does that ring a bell?

Hmm not really. I don't recall ever copying things from my phone other than pictures. I do use ADB for that but I don't believe that that's the culprit. I have just tried connecting my phone and copying some files over and it didn't chown my home.

ondoho · 2020-09-22 07:25:50

My old ArchLinux install used "ondoho:users" iirc, my new install uses "ondoho:ondoho".
The old install never had any problems with it though.
Is yours an old install?

Did you do any troubleshooting at all - on system (IDK, maybe 'stat' can help), on web?
Does group 9999 have a human-readable name?

When did it happen? What did you do just before that?

TheEdgeOfRage · 2020-09-22 11:08:08

ondoho wrote:

My old ArchLinux install used "ondoho:users" iirc, my new install uses "ondoho:ondoho".
The old install never had any problems with it though.
Is yours an old install?
Did you do any troubleshooting at all - on system (IDK, maybe 'stat' can help), on web?
Does group 9999 have a human-readable name?
When did it happen? What did you do just before that?

It's a relatively new install (2020-06-10).

The GID is not named, it's not defined in /etc/group and recursive grepping /etc doesn't show any file mentioning 9999 either.

I have tried looking on the web if somebody has had a similar problem, but couldn't find anything.

I don't know when it happened as I didn't notice it until yesterday. If I at least knew what I had been running then I could have an idea what might have caused it.

Maybe I mounted my home folder into a Docker container at some point which set the chown, but then again, why just .ssh and .gnupg. And I don't recall ever mounting my whole home into a container. I don't see how anything that I use could need that.

schard · 2020-09-22 11:11:37

Did you check the output of stat as mentioned?
Also, did you search for any other files owned by that group?

# find / -group 9999

Last edited by schard (2020-09-22 11:11:48)

TheEdgeOfRage · 2020-09-22 11:17:53

schard wrote:

Did you check the output of stat as mentioned?
Also, did you search for any other files owned by that group?
# find / -group 9999

Found the culprit

https://hub.docker.com/r/x11vnc/desktop

I ran that container using their script, which after looking at it in more detail does mount the user's home folder into the container.
It left a volume behind that had files with 9999 as their owner GID. (/var/lib/docker/volumes/x11vnc_latest_config/ for reference)

I ran the container again using just docker run and found that the ubuntu group has a 9999 GID in /etc/group.

Thank you all for helping me solve this mystery. Much appreciated.

Arch Linux

#1 2020-09-21 19:12:44

[SOLVED] Home and some subdirectories have GID 9999 as owner group

#2 2020-09-21 20:45:27

Re: [SOLVED] Home and some subdirectories have GID 9999 as owner group

#3 2020-09-21 20:51:04

Re: [SOLVED] Home and some subdirectories have GID 9999 as owner group

#4 2020-09-21 21:12:50

Re: [SOLVED] Home and some subdirectories have GID 9999 as owner group

#5 2020-09-21 21:34:57

Re: [SOLVED] Home and some subdirectories have GID 9999 as owner group

#6 2020-09-22 07:25:50

Re: [SOLVED] Home and some subdirectories have GID 9999 as owner group

#7 2020-09-22 11:08:08

Re: [SOLVED] Home and some subdirectories have GID 9999 as owner group

#8 2020-09-22 11:11:37

Re: [SOLVED] Home and some subdirectories have GID 9999 as owner group

#9 2020-09-22 11:17:53

Re: [SOLVED] Home and some subdirectories have GID 9999 as owner group

Board footer