2

When I create a folder named system in my home folder, or in /tmp (can't try other locations as I am not root, but owner confirmed same problem even on root), ls -a will not show it. Also tried /bin/ls -a, same deal. Otherwise the folder "works" fine, I can cd into it, pwd shows the right location and everything. I can even rename it to something else and ls will show it then. But if I rename it back to system, ls will not show it anymore. Please note even if I remove the folder completely, or create it in a location where it previously didn't exist, with "mkdir system", it will not be shown by ls unless I rename it to something else. "echo *" shows the system folder. dir behaves same as ls (doesn't show the folder). Other folders with different names work fine and show up.

Distro is CentOS 5.6. I have another box with CentOS 5.5 and I DO NOT have this issue there. I don't think it's distro-related. I do not have root access but owner confirmed the problem on root as well.

Info about mount point from /etc/mtab: /dev/mapper/VolGroup00-LogVol00 / ext3 rw 0 0

Improve this question
8
  • How very bizarre. I'm extremely curious as to what's going on here. It sounds like something in the ls tool itself since echo * works.
    – Omnifarious
    Commented Jun 3, 2011 at 7:15
  • 9
    Sounds like a compromised box.
    – cnicutar
    Commented Jun 3, 2011 at 7:16
  • anybody know if this is a symptom of a rootkit?
    – ysth
    Commented Jun 3, 2011 at 7:17
  • @ysth I don't think it's a rootkit (bash globs it fine).
    – cnicutar
    Commented Jun 3, 2011 at 7:18
  • 2
    You should md5sum /bin/ls and check it against another CentOS 5.6.
    – Heandel
    Commented Jun 3, 2011 at 8:17

1 Answer 1

Reset to default
1

A simple alias ls="ls | grep -v system" would do it. Sounds like a prank or a rootkit. Were there any files within the directory?

Improve this answer
2
  • An alias would not stop /bin/ls working, with the OP tried.
    – camh
    Commented Jun 3, 2011 at 13:34
  • Thanks for your answer. It was a rootkit (probably BeastKit).
    – mrbrdo
    Commented Jun 11, 2011 at 22:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .