Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top
cd /serv  
screen -R node  
{in the screen}  
node test.js  
C^a d  


ls -l /dev/pts  
total 0  
crw--w---- 1 tick-tock tty 136, 0 2011-04-19 16:41 0  
crw--w---- 1 tick-tock tty 136, 1 2011-04-19 16:41 1 

but after just a few seconds

ls -l /dev/pts  
total 0  
crw--w---- 1 tick-tock tty 136, 0 2011-04-19 16:47 0  
crw--w---- 1 root      tty 136, 1 2011-02-21 20:00 1  

How is the screen's terminal getting switched to root? Does this mean the node server is actually running with root permissions? It shouldn't be. The only other factor that might be an issue is that iptables forwards port 80 to port 8000 where the node server listens, so it doesn't have to run as root. I apologize if this is the wrong place to ask this, perhaps I should ask in a node.js community?

I have not su root or done any sudo commands beforehand, either.

share|improve this question
I find the date change on /dev/pts/1 also strange. This doesn't mean node.js is running as root (it can't be unless it's setuid root, and that has absolutely nothing to do with the port forwarding). What OS is this? Is there any virtualization, SELinux or other element worth mentioning? Are there other users on this machine? – Gilles Apr 19 '11 at 17:52
what's also pretty strange is the date going back to Feb. 21st. – Mat Apr 19 '11 at 18:19
This smacks of something fundamentally wrong, like a compromised system and you're tracking the effect of ghosts on the woodwork of a house. I don't know exactly what to say to look for, but we aren't seeing the whole picture yet. – Caleb Apr 19 '11 at 18:48
Ubuntu 10.04.1 LTS, it is a VPS. There is one other user it's just an account for a friend of mine, he doesn't do anything on the box and I know his pass if I need to do anything as him. There's nothing else running either, and no it looks like node isn't running as root so I dunno what is up with that terminal. Here's the output of htop pastebin.com/EHvDXXQp – Tick-Tock Apr 20 '11 at 15:21

Your system, once screen detaches, destroys the pts, and for some reason recreates it, if I understand correctly how udev is handling things on your system.

udev is the subsystem that controls the creation and destruction of devices in /dev, which is a dynamically generated filesystem. pts creation/destruction is handled by ptmx, which is used to create pseudo-terminal master/slave pairs. pts/* is the slave of the respective PTM, or pseudo-terminal master. As such, any permissions modifications that you see are a direct result of the destruction and creation of said device nodes, rather than modification. As for the date of the file, since the device nodes are clones, it's likely that the original used to create these nodes had a creation date of the time that you see in your ls output.

  • man ptmx -- Describes how ptmx creates new pts pseudo terminal device nodes.

What I don't understand is why there is a difference between how your system behaves versus how mine behaves with regard to /dev/pts/*. I do not experience perceived perms changes to devices; They either disappear entirely which is as it should be, or the perms do not change regardless of my actions (e.g., detaching screen, the device stays, and does not get destroyed/recreated.). Not only that, but the dates associated with my newly created pts/* devices are the current date.

One possibility is that the VPS you're using has something to do with this behavior. For example, I can't perform a dist-upgrade on my VPS, since the system they utilize only allows for one kernel version, the one they've hacked and put in place. The kind of restrictions that prevent you from updating your own kernel could also impact the functionality of other sub-systems. That's just speculation though, but it would make sense.

It could also just be a difference in how udev is configured.

Revision 3, with a lot of help from Gilles. ;)

share|improve this answer
The kernel is not going to change the permissions of a file of its own accord, even the file is a device node. (The kernel does, however, choose the owner and permissions of a /dev/pts/* node when it is created.) – Gilles May 4 '11 at 22:47
Gilles, we were both wrong. The kernel doesn't make these mods directly, thank you for the correction. But permissions on device nodes are modified occasionally by other processes, after initialization. – Sean Lewis May 5 '11 at 20:32
I don't see where in your write-up you've found that something would be changing the permissions on /dev/pts/*. The device entry disappears when it stops being used, and a new one is created when needed. Unlike the old /dev/pty*, these entries are not reused, AFAIK. – Gilles May 5 '11 at 20:45
sigh .. I guess you're right again. Thanks for challenging my understanding of this ! :) – Sean Lewis May 5 '11 at 22:12

Screen has several compile time options, one of them is multi-user mode. If installed in this mode screen is usually installed with suid root. See multiuser mode docs. Is yours installed this way? What is the output of ls -l /usr/bin/screen?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.