There are a handful of Solaris zones that run a rc3.d/ script (which is normal), however, there is a single script that runs during boot and removes itself upon completion. (This is known from viewing the script elsewhere on another box, which is apart of some legacy/defunct programs.) For whatever reason the script reappears after every boot of the zone and executed--which has been verified by browsing /var/svc/log/milestone-multi-user-server\:default.log

The problem/question begins with this: What in the world can cause the script to reappear in rc3.d/? In fact, there is no rc2.d/ rc3.d/ init.d/ script which run beforehand that might cp the script over to rc3.d/, and the script itself does not seem to reside anywhere in the zone or global. And, a further note, I have not been able to find a (obvious) SMF service that might run a script to do the above action.


2 Answers 2


I'd try the following in the order specified (because each command that follows will likely take much longer to run than the previous one):

1: On the non-global zone, run

find / -name name_of_rc3_script

2: If that doesn't give any results, do the same from the global zone.

3: If that doesn't give any useful output either, then from the non-global zone:

find / | xargs grep name_of_rc3_script

4: If that gives no useful output, then run that from the global zone too.

3 and 4 have the potential to take a very long time depending on the size of attached file systems. You may want to limit what is searched to local file systems only - man find for info on how to do this.

1 and 2 assume that the script name is the same wherever it resides when it isn't in /etc/rc3.d. It may or may not have the same file name. While it will hopefully show the location of the file, you will then need to work out what is copying it to /etc/rc3.d on the non-global zone.

3 and 4 will search each file on the system for name of the script and should hopefully find whatever file is copying it regardless of the filename as the destination of the script should match the script name. this should show what is doing the copying.


You are hinting that this is a Solaris script/function, but based on your description, it sounds like something else, possibly malicious is on your system. The name of the script would also have been useful.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .