permissions all zero when using 'cp'

12-30-2010, 12:56 AM

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear Gurus,

i recently noticed some errors at my mail-server and so I tried to drill
it down with my limited abilities.

what I found is really strange:

when copying a file (no matter which) the copy gets zero permissions.

looks like that:

root@X:/tmp# ls -altr
insgesamt 20
drwxrwxrwt 2 root root 4096 29. Dez 15:06 .X11-unix
drwxrwxrwt 2 root root 4096 29. Dez 15:06 .ICE-unix
drwx------ 2 mlo users 4096 29. Dez 21:38 ssh-VkxmJ15962
- - -rw-rw-r-- 1 root root 0 29. Dez 21:47 test
drwxr-xr-x 21 root root 4096 29. Dez 22:06 ..
drwxrwxrwt 5 root root 4096 29. Dez 22:22 .

notice the file "test"

root@X:/tmp# cp test test.bak
root@X:/tmp# cp -p test test.bak2
root@X:/tmp# ls -altr
insgesamt 36
drwxrwxrwt 2 root root 4096 29. Dez 15:06 .X11-unix
drwxrwxrwt 2 root root 4096 29. Dez 15:06 .ICE-unix
drwx------ 2 mlo users 4096 29. Dez 21:38 ssh-VkxmJ15962
- - -rw-rw-r-- 1 root root 0 29. Dez 21:47 test.bak2
- - -rw-rw-r-- 1 root root 0 29. Dez 21:47 test
drwxr-xr-x 21 root root 4096 29. Dez 22:06 ..
- - ---------- 1 root root 0 29. Dez 22:22 test.bak
drwxrwxrwt 5 root root 4096 29. Dez 22:22 .

now kindly notice test.bak and test.bak2

whenever I copy a file it ends up with this permission string: "----------"

no matter if I do this as root or as user

this also happens in my maildir, which causes the strange problems I had.

- - -- System Information:
Debian Release: 5.0.1
APT prefers oldstable
APT policy: (500, 'oldstable'), (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 2.6.9-023stab052.4-smp (SMP w/4 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJNG+bAAAoJECZ8myNlGwU12LYH/3lIkDgdJet9J4XNGspzyAwA
WSj2y+IC7wz8mDdLks7SyTOmh/89W/j01pexsl5gMyh06N/cFde8WIgIAkSq7H4j
iBS3iy5AnnXyqYVt2EdYUAHf6kL3plVTczBs2NwhyipYWwdqg7 GNUo4qxXwMMuRC
UepoOjoQ0cxeBj3QBTMdSWvRcXOCp7ZWgxAMXOPnWHGEfGnKwu 8456YUkf+Ui/nc
OYEfdUMtIbDsaotdQcJmdcy8hU5DbR+yqNzQqvi5YJDGSYaVbf 4XsL+iBugjJ3Eo
vEV7u33yTELe8nI+lJ3mQe1cfJ2Gq3/7yk5GaMi3hXewpOqabi0C44RSQsHAXCw=
=xpKu
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 4D1BE6C0.4080804@lorenz.priv.at">http://lists.debian.org/4D1BE6C0.4080804@lorenz.priv.at

12-30-2010, 01:41 AM

On Wed December 29 2010 17:56:16 Martin Lorenz wrote:
> when copying a file (no matter which) the copy gets zero permissions.

What's the result of running the "umask" command?

Normally it's something like "0022". You may have "0777".

--Mike Bird

--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 201012291841.43361.mgb-debian@yosemite.net">http://lists.debian.org/201012291841.43361.mgb-debian@yosemite.net

12-30-2010, 01:50 AM

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

that was my first guess ...

$ umask
0022

should have mentioned
sorry

Am 30.12.2010 03:41, schrieb Mike Bird:
> On Wed December 29 2010 17:56:16 Martin Lorenz wrote:
>> when copying a file (no matter which) the copy gets zero permissions.
>
> What's the result of running the "umask" command?
>
> Normally it's something like "0022". You may have "0777".
>
> --Mike Bird
>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJNG/OHAAoJECZ8myNlGwU1hwkH+waEC5iAJXHsyoor4O2AZxNi
dudLNuZ1rE5w3QMkmgm5FS2da9vQBzDmCStjnqgqWCeCjtrReZ VFVQKussJsdMTD
tjfc1F7nD3Niiw2c0wCoVMS4s/CNJ+Z4K9m4pUZtM8EcY7qOjydLOuadV5Erf8lr
zQzLH4rnZ/Rzo9TSDKCFsIIh/QIeNWB3cKD0z2VNcc/ZxLIkeT+sOwuMv8w7FJNJ
Ecs2m5vofopxZ+bpMLrio2ZAwNQzVwGL7nusezz/gE+ZEsi/mhuYDe+R/F8buPpy
y357Z0PywpnN55VRRG26LBPWRyAXi/iU4dKW5V97qgu2CQyHtzeIIniOlyGjhpU=
=91an
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 4D1BF387.1040608@lorenz.priv.at">http://lists.debian.org/4D1BF387.1040608@lorenz.priv.at

12-30-2010, 02:04 AM

Martin Lorenz wrote:
> what I found is really strange:
> when copying a file (no matter which) the copy gets zero permissions.

That is very strange. And I feel must be in your personal
environment. If it were in the system then I think your system would
have massive failures and would exhibit other problems.

Are you sure you are getting the system cp and not an alias or
wrapper?

$ type cp
cp is /bin/cp

Try running in a clean environment to see if it is an environment
variable. 'env -i' will initialize an empty environment.

$ umask
0002

$ date -R > testfile1
$ ls -ldog testfile1
-rw-rw-r-- 1 32 Dec 29 20:00 testfile1

$ rm -f testfile2
$ env -i cp testfile1 testfile2
$ ls -ldog testfile2
-rw-rw-r-- 1 32 Dec 29 20:00 testfile2

If that still shows a problem then look deeper with strace.

$ rm -f testfile2
$ strace -v -e trace=file -o /tmp/cp.strace.out cp testfile1 testfile2

Then look through the cp.strace.out file to see what it is doing. I
expect to see something like this:

open("testfile1", O_RDONLY) = 3
open("testfile2", O_WRONLY|O_TRUNC) = 5

Bob

12-30-2010, 02:40 AM

I see Bob Proulx offered some great suggestions. Here are few thoughts:

Are you running anything like selinux?

Could a clumsy rootkit have gotten into your system?

What are the permissions of files created with touch, mkdir, vi?

I'm not sure if anything bad in the filesystem could do this but
you might want to try a fsck.

--Mike Bird

--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 201012291940.37451.mgb-debian@yosemite.net">http://lists.debian.org/201012291940.37451.mgb-debian@yosemite.net

12-30-2010, 04:17 PM

On 12/29/2010 05:56 PM, Martin Lorenz wrote:
> Dear Gurus,
>
> i recently noticed some errors at my mail-server and so I tried to drill
> it down with my limited abilities.
>
> what I found is really strange:
>
<-deleted->

> root@X:/tmp# ls -altr
> insgesamt 20
> drwxrwxrwt 2 root root 4096 29. Dez 15:06 .X11-unix
> drwxrwxrwt 2 root root 4096 29. Dez 15:06 .ICE-unix
> drwx------ 2 mlo users 4096 29. Dez 21:38 ssh-VkxmJ15962
> - - -rw-rw-r-- 1 root root 0 29. Dez 21:47 test
> drwxr-xr-x 21 root root 4096 29. Dez 22:06 ..
> drwxrwxrwt 5 root root 4096 29. Dez 22:22 .
>
> notice the file "test"
>
> root@X:/tmp# cp test test.bak
> root@X:/tmp# cp -p test test.bak2
> root@X:/tmp# ls -altr
> insgesamt 36
> drwxrwxrwt 2 root root 4096 29. Dez 15:06 .X11-unix
> drwxrwxrwt 2 root root 4096 29. Dez 15:06 .ICE-unix
> drwx------ 2 mlo users 4096 29. Dez 21:38 ssh-VkxmJ15962
> - - -rw-rw-r-- 1 root root 0 29. Dez 21:47 test.bak2
> - - -rw-rw-r-- 1 root root 0 29. Dez 21:47 test
^^^^
> drwxr-xr-x 21 root root 4096 29. Dez 22:06 ..
> - - ---------- 1 root root 0 29. Dez 22:22 test.bak
> drwxrwxrwt 5 root root 4096 29. Dez 22:22 .
>
> now kindly notice test.bak and test.bak2
<-deleted->

I'm not sure if this is relevant, but the ls output lines for these
files look odd, having "extra" '- ' characters at the start.

Older 'ls' commands (not Gnu) might do this, if the file name contained
a literal carriage return character, but the 'ls' on my system prints a
question mark for non-printing/graphic characters.

You could try the '-b' option and see what that prints. The Gnu ls uses
backslash escapes (
, , octnum etc.). This might help in searching
strace output, if you do try Bob Proulx's suggestion, since you would
know the actual character to look for.

Also, you ran the above as root. Since the original file is readable by
all, what happens if you do the copy as a regular user?

--
Bob McGowan

--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 4D1CBEBF.1050508@symantec.com">http://lists.debian.org/4D1CBEBF.1050508@symantec.com

12-30-2010, 06:26 PM

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear Bob,

thank you for the hints
I tried out, what you suggested.
here are the results:

Am 30.12.2010 04:04, schrieb Bob Proulx:
> type cp
> Martin Lorenz wrote:
>> > what I found is really strange:
>> > when copying a file (no matter which) the copy gets zero permissions.
> That is very strange. And I feel must be in your personal
> environment. If it were in the system then I think your system would
> have massive failures and would exhibit other problems.
>
> Are you sure you are getting the system cp and not an alias or
> wrapper?
>
> $ type cp
> cp is /bin/cp
>

as user:

mlo@vs152058:~$ type cp
cp is aliased to `cp -i'

as root:

root@vs152058:~# type cp
cp is /bin/cp

> Try running in a clean environment to see if it is an environment
> variable. 'env -i' will initialize an empty environment.
>
> $ umask
> 0002
>

root@vs152058:~# (
> env -i
> umask
> )
0022

> $ date -R > testfile1
> $ ls -ldog testfile1
> -rw-rw-r-- 1 32 Dec 29 20:00 testfile1
>
> $ rm -f testfile2
> $ env -i cp testfile1 testfile2
> $ ls -ldog testfile2
> -rw-rw-r-- 1 32 Dec 29 20:00 testfile2
>

root@vs152058:~# (
> env -i
> date -R > testfile1
> ls -ldog testfile1
> echo
> rm -f testfile2
> echo
> cp testfile1 testfile2
> ls -ldog testfile2
> )
- -r-Sr-x--- 1 32 30. Dez 20:22 testfile1

- ---------- 1 32 30. Dez 20:22 testfile2

> If that still shows a problem then look deeper with strace.
>
> $ rm -f testfile2
> $ strace -v -e trace=file -o /tmp/cp.strace.out cp testfile1 testfile2
>
> Then look through the cp.strace.out file to see what it is doing. I
> expect to see something like this:
>
> open("testfile1", O_RDONLY) = 3
> open("testfile2", O_WRONLY|O_TRUNC) = 5
>
stat64("testfile2", 0xbfffd7b0) = -1 ENOENT (No such file or
directory)

stat64("testfile1", {st_dev=makedev(144, 109), st_ino=37590572,
st_mode=S_IFREG|S_ISUID|0450, st_nlink=1, st_uid=0, st_gid=0,
st_blksize=4096, st_blocks=8, st_size=32, st_atime=2010/12/30-20:22:29,
st_mtime=2010/12/30-20:22:29, st_ctime=2010/12/30-20:22:29}) = 0

stat64("testfile2", 0xbfffd624) = -1 ENOENT (No such file or
directory)

open("testfile1", O_RDONLY|O_LARGEFILE) = 3
open("testfile2", O_WRONLY|O_CREAT|O_EXCL|O_LARGEFILE, 0) = 4

does this tell you something?

thank you for your help

regards
martin
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJNHNzdAAoJECZ8myNlGwU11nUH/3vVPEIe+2tuf+kYHg9deuzu
h0zLFUUzePSBIrlsoZNNlGBkKUp9O7Y4L3WnK+QHTz9i7xisnV nb4X/m/ubFrFds
Oy8AehUHry24XohHzCYcMhToWlZ8kzSJhKpl9Wy72QjsClIU/ZHV3weS+0ecj/3G
MeGo+b5fiym1Rpl3nRyj7clDpdCxxgSS2IF8m9DsyifC1Zw1TV MHl+OwwXBJDoQv
I7M3Rnt0IW6WYnHBVUWekm91o2gCemMrCZ0lhE952OdBXm9cG2 ecT4FmC03XZAAu
zxyikYdL0go6UJQso/i6qrOBYJ6gNL63ICEWsahQYaDXzXyEfDB3NLabKjKUs3I=
=iynZ
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 4D1CDCE7.50806@lorenz.priv.at">http://lists.debian.org/4D1CDCE7.50806@lorenz.priv.at

12-30-2010, 06:27 PM

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Am 30.12.2010 04:40, schrieb Mike Bird:
> I see Bob Proulx offered some great suggestions. Here are few thoughts:
>
> Are you running anything like selinux?
>
> Could a clumsy rootkit have gotten into your system?

this thought already hit me too :-(

>
> What are the permissions of files created with touch, mkdir, vi?
>
> I'm not sure if anything bad in the filesystem could do this but
> you might want to try a fsck.
>
> --Mike Bird
>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJNHN0zAAoJECZ8myNlGwU1j+8H/3mm3mQMhfvc9pyTSGOjpv95
A4vSrwwRziM5ZFRko4SdXaRqJcWPJpykb78zCxQ/0MzI3VvJP8OmEtmTI/XhrKMP
mT2tufI6Erv1J+w+gdepQ1jnRKdy6r9dQbXnYM9zB/wLr47A0MWV/vDc9KnIBSmN
aDRHZu4BP94qWxjYad5kXtrEMLDPQrsjQVd52+iqoVrfA4gkyF 7/0npWRlDrX4uz
IZvJkq/VmOU/8znsItIoVdp2QbVGVmb0pGlenUID9MAHvqS0h3VRbBnVNRnSoW wS
8VBRBTRLsl5v4kg0kxa1fmZWEbk7WCP6+v3SpuRmUtLRxWk8zF NXQmVrt6qjF6s=
=9cEt
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 4D1CDD33.9060005@lorenz.priv.at">http://lists.debian.org/4D1CDD33.9060005@lorenz.priv.at

12-30-2010, 06:31 PM

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I am afraid (just noticed this as you mention it) this extra dash is an
artefact added by my mail client (thunderbird) to escabe the double-dash
at the beginning of a line.

Am 30.12.2010 18:17, schrieb Bob McGowan:
> On 12/29/2010 05:56 PM, Martin Lorenz wrote:
>> Dear Gurus,
>>
>> i recently noticed some errors at my mail-server and so I tried to drill
>> it down with my limited abilities.
>>
>> what I found is really strange:
>>
> <-deleted->
>
>> root@X:/tmp# ls -altr
>> insgesamt 20
>> drwxrwxrwt 2 root root 4096 29. Dez 15:06 .X11-unix
>> drwxrwxrwt 2 root root 4096 29. Dez 15:06 .ICE-unix
>> drwx------ 2 mlo users 4096 29. Dez 21:38 ssh-VkxmJ15962
>> - - -rw-rw-r-- 1 root root 0 29. Dez 21:47 test
>> drwxr-xr-x 21 root root 4096 29. Dez 22:06 ..
>> drwxrwxrwt 5 root root 4096 29. Dez 22:22 .
>>
>> notice the file "test"
>>
>> root@X:/tmp# cp test test.bak
>> root@X:/tmp# cp -p test test.bak2
>> root@X:/tmp# ls -altr
>> insgesamt 36
>> drwxrwxrwt 2 root root 4096 29. Dez 15:06 .X11-unix
>> drwxrwxrwt 2 root root 4096 29. Dez 15:06 .ICE-unix
>> drwx------ 2 mlo users 4096 29. Dez 21:38 ssh-VkxmJ15962
>> - - -rw-rw-r-- 1 root root 0 29. Dez 21:47 test.bak2
>> - - -rw-rw-r-- 1 root root 0 29. Dez 21:47 test
> ^^^^
>> drwxr-xr-x 21 root root 4096 29. Dez 22:06 ..
>> - - ---------- 1 root root 0 29. Dez 22:22 test.bak
>> drwxrwxrwt 5 root root 4096 29. Dez 22:22 .
>>
>> now kindly notice test.bak and test.bak2
> <-deleted->
>
> I'm not sure if this is relevant, but the ls output lines for these
> files look odd, having "extra" '- ' characters at the start.
>
> Older 'ls' commands (not Gnu) might do this, if the file name contained
> a literal carriage return character, but the 'ls' on my system prints a
> question mark for non-printing/graphic characters.
>
> You could try the '-b' option and see what that prints. The Gnu ls uses
> backslash escapes (
, , octnum etc.). This might help in searching
> strace output, if you do try Bob Proulx's suggestion, since you would
> know the actual character to look for.
>
> Also, you ran the above as root. Since the original file is readable by
> all, what happens if you do the copy as a regular user?
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJNHN4KAAoJECZ8myNlGwU16YoIAJ04J8dyXK zU9AAck39px14V
39sRBNc04TSjkbfpKN2wedJLGjLRThPbEqfEAm9xkf0YPn1p4G yv7CV4hhWvBXj2
wedSoCfWKfyCvAFDkFhQjl2foKMYMB6r/zastqIwm3TgivtYnVqIklyMwxB7mxD6
r5DadiASn3jwFTi5Zu8Al+J4VadJX3r/IVHsXQ13vqYrnHvrlzFPrfWU3CT5C42m
rDdHRYR/R51aLlmCpl6PBi9+hfXpNZpFd0ulTQd/XBD7ARik/O2O2rFwEI1b+L47
rfuDB0yJ25FYNeYvzz3QALIpaSiCkcZQDO/te78b+KXyGdUXbLyErXTbRqzXOIc=
=0nN0
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: 4D1CDE0A.3060505@lorenz.priv.at">http://lists.debian.org/4D1CDE0A.3060505@lorenz.priv.at

12-30-2010, 07:03 PM

Martin Lorenz wrote:
> mlo@vs152058:~$ type cp
> cp is aliased to `cp -i'
>
> as root:
>
> root@vs152058:~# type cp
> cp is /bin/cp

It looks okay. I was hoping that it pointed to a different command
that could be traced to a problem. But apparently not.

> > Try running in a clean environment to see if it is an environment
> > variable. 'env -i' will initialize an empty environment.

It looks okay. I was hoping that an environment variable such as
LD_PRELOAD or LD_LIBRARY_PATH would have pointed to a rogue library.
Without that in the environment it would work. But apparently not.

Those two ideas were my best guesses at what could cause such strange
behavior. Unfortunately your reply information does not show anything
wrong that I can see in either of those two cases.

> > If that still shows a problem then look deeper with strace.
> > $ strace -v -e trace=file -o /tmp/cp.strace.out cp testfile1 testfile2
> open("testfile1", O_RDONLY|O_LARGEFILE) = 3
> open("testfile2", O_WRONLY|O_CREAT|O_EXCL|O_LARGEFILE, 0) = 4

That is perfectly normal for a 32-bit system. Okay.

> does this tell you something?

Unfortunately your information looked normal and did not point me
toward anything that looked like a problem.

Mike Bird's guess at selinux was a good question.

I am not conversationally fluent with filesystem attributes. Is it
possible that 'chattr' was run on your filesystem? Try running
'lsattr' and listing the filesystem attributes to see if something has
been set. You will need to read the documentation for information as
I know little about it but only that they exist. For me I only see
dashes on my filesystem because I have not set any attributes.

lsattr

Sorry but I do not know. I have exhausted my guesses.

Bob