Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I create a folder named system in my home folder, or in /tmp (can't try other locations as I am not root, but owner confirmed same problem even on root), ls -a will not show it. Also tried /bin/ls -a, same deal. Otherwise the folder "works" fine, I can cd into it, pwd shows the right location and everything. I can even rename it to something else and ls will show it then. But if I rename it back to system, ls will not show it anymore. Please note even if I remove the folder completely, or create it in a location where it previously didn't exist, with "mkdir system", it will not be shown by ls unless I rename it to something else. "echo *" shows the system folder. dir behaves same as ls (doesn't show the folder). Other folders with different names work fine and show up.

Distro is CentOS 5.6. I have another box with CentOS 5.5 and I DO NOT have this issue there. I don't think it's distro-related. I do not have root access but owner confirmed the problem on root as well.

Info about mount point from /etc/mtab: /dev/mapper/VolGroup00-LogVol00 / ext3 rw 0 0

share|improve this question

migrated from stackoverflow.com Jun 3 '11 at 12:37

This question came from our site for professional and enthusiast programmers.

How very bizarre. I'm extremely curious as to what's going on here. It sounds like something in the ls tool itself since echo * works. – Omnifarious Jun 3 '11 at 7:15
Sounds like a compromised box. – cnicutar Jun 3 '11 at 7:16
anybody know if this is a symptom of a rootkit? – ysth Jun 3 '11 at 7:17
@ysth I don't think it's a rootkit (bash globs it fine). – cnicutar Jun 3 '11 at 7:18
You should md5sum /bin/ls and check it against another CentOS 5.6. – Heandel Jun 3 '11 at 8:17
up vote 1 down vote accepted

A simple alias ls="ls | grep -v system" would do it. Sounds like a prank or a rootkit. Were there any files within the directory?

share|improve this answer
An alias would not stop /bin/ls working, with the OP tried. – camh Jun 3 '11 at 13:34
Thanks for your answer. It was a rootkit (probably BeastKit). – mrbrdo Jun 11 '11 at 22:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.