You are not logged in.
I know it doesn't prove anything
You don't need to prove anything - this isn't about you at all. I just want to know who's making people suid'ing random binaries.
Speaking of which:
find /usr/bin -perm -4000Maybe there's more? Some two dozen will show up, that's normal. But it should not be hundreds.
really don't know what's the cause.
grep chmod ~/.bash_historywarning: systemd: /var/log/journal (No such file or directory)
sudo mkdir -m 2755 /var/log/journal
sudo chown root:/systemd-journal /var/log/journalDo the permission errors remain?
Offline
output of find command: http://ix.io/3HFd
Executing the last two commands still gives "insufficient permissions"
And strangely, my bash history has some commands missing, and its even randomly arranged, maybe because of incorrect time, and since it's not configured, the history is very short. Like, there is no trace of "chmod" in any command, or even strace, some other commands are missing around that time. I checked the root user history as well, nothing in there as well.
I'll just link to both of them.
Tried to check a 6 day old (5 Dec) snapshot, but the snapshot itself is empty, this was the time I accidentally deleted the "home" subvolume. I installed arch on 3rd Dec so anything between that would be lost. The only time I can remember messing with permission is when I wasn't able to use `makepkg` ( but it wasn't related to systemctl ) becauase I had created the home directory as root (after deleting the subvol) . And.. just before accidentally deleting home subvolume, I also did a `sudo rm -r /` (while it was mounted), while trying to rollback root directory, and when I did, it was a read-only snapshot, so had to fix it again. I was messing around with btrfs and booting process. I am quite sure I hadn't installed any other program during that time, since I was didn't install any GUI.
Other than that, I used systemctl in chroot, which gave some error like "can't use systemctl in chroot" maybe. I needed to do it because I had masked the fsck@.service (instead of remount fsck, i guess)
`sarthak` user history
root user history
And thanks again for the help!. Would have taken an eternity for me to figure it out
Last edited by sarthak1 (2021-12-11 06:04:26)
Offline
There're no suspicious suid binaries in that list.
Executing the last two commands still gives "insufficient permissions"
What?
mount | grep var
stat /var
stat /var/logOffline
$ mount | grep var
efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime)Both the directories have `755/drwxr-xr-x`
It's fine after a reboot.
Offline