Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

In /var/www I've got a folder:

d--------- 2 www-data www-data  4096 May 20  2012 update

reported by ls -la.

I'm logged in as root, but I can't change permissions or ownership. chown and chmod returns 'Operation not permitted'

An automatic update procedure demands all files and folders to be owned by 'www-data' and permissions set to 'u+w'.

share|improve this question
1  
SELinux, AppArmor or similar active? Have a look at dmesg | tail -n 20 immediately after the chown/chmod call. It may be a good idea to run fsck on that filesystem. Is that directory a mount point? –  Hauke Laging Jun 2 at 11:11
4  
Try lsattr on it as well to see if the immutable bit is set. Is it a mountpoint for a special kind of filesystem? –  Stéphane Chazelas Jun 2 at 11:26
    
Yep, lsattr reports the immutable bit is set. –  Prosaicon Jun 2 at 11:36
6  
Depending on why that bits set, sudo chattr -i /var/www/update will turn it off, but ask yourself why is that bit set in the first place? –  slm Jun 2 at 13:00
    
@slm Please post that as an answer. Right now the question is sitting on the unanswered list, but it isn't really unanswered. –  derobert Jun 24 at 15:59
show 1 more comment

1 Answer

As I searched through the list of unanswered questions for ones that I might be able to answer, I saw this question’s title and I figured that it might be an issue with file attributes. As detailed in the question’s comments, the immutable attribute had been set and @slm posted the solution:

sudo chattr -i /var/www/update

However, @slm also asked a very pertinent question, “why is that bit set in the first place?” The first time I learned of the immutable bit was when I was asked to look at a server that had been rooted. The binaries for ps and lsof had been replaced with modified versions (in order to hide other malicious processes) and the immutable bit had been set to prevent any future OS updates from replacing the malicious executables with updated genuine versions.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.