6

In general, what are the reasons why a filetype might show as unknown (?) in ls output?

See the first bit for the file /sbin/start-stop-daemon, which should indicate - for "regular file", instead is displayed as ? for "unknown".

ts7500:~# ls -alh /sbin/s*
-rwxr-xr-x 1 root  root  52K Apr 29  2008 /sbin/sfdisk
-rwxr-xr-x 1 root  root  875 Dec  6  2009 /sbin/shadowconfig
-rwxr-xr-x 1 root  root  12K Apr 19  2010 /sbin/showmount
-rwxr-xr-x 1 root  root  18K Aug 12  2008 /sbin/shutdown
-rwxr-xr-x 1 root  root  28K Nov 16  2008 /sbin/slattach
-rwxr-xr-x 1 root  root  12K Apr 19  2010 /sbin/sm-notify
-rwxr-xr-x 1 root  root  58K Jul 27  2008 /sbin/ss
?rwsrwsrwt 1 65535 root 4.0G Dec 31  1969 /sbin/start-stop-daemon
-rwxr-xr-x 1 root  root  19K Aug 12  2008 /sbin/startpar
-rwxr-xr-x 1 root  root 9.8K Aug 12  2008 /sbin/sulogin
lrwxrwxrwx 1 root  root    6 Jun  9  2011 /sbin/swapoff -> swapon
-rwxr-xr-x 1 root  root  17K Apr 29  2008 /sbin/swapon
-rwxr-xr-x 1 root  root  11K Aug  6  2009 /sbin/sysctl
  • 11
    Looks like a corrupt file system to me. (4.0G size, uid=65535, date=1969; every bit lit up like a Christmas tree.) – oals Oct 21 '16 at 16:04
12

Given that your start-stop-daemon is 4GB in size and dated Dec 31, 1969, I suspect your filesystem may be corrupted...

sudo touch /forcefsck

and then reboot to check your filesystem.

The question mark in ls's output here comes from the filetype_letter array (in GNU ls):

/* Display letters and indicators for each filetype.
   Keep these in sync with enum filetype.  */
static char const filetype_letter[] = "?pcdb-lswd";

This corresponds to C_ORPHAN:

#define FILETYPE_INDICATORS                             \
  {                                                     \
    C_ORPHAN, C_FIFO, C_CHR, C_DIR, C_BLK, C_FILE,      \
    C_LINK, C_SOCK, C_FILE, C_DIR                       \
  }

and unknown in the filetype enum, and is the default for a file of unknown type:

          /* Classify a file of some other type as C_ORPHAN.  */
          type = C_ORPHAN;

(ls implementations are free to add their own characters to those defined by POSIX.)

  • 2
    Thank you for a possible solution, though in my case I prefer to create a new root image. I was more curious about the reasons for the ?. – Chris Merck Oct 21 '16 at 16:10
  • 2
    Why is the time a hint? Is there something special about it? Do problematic files default to a second before the beginning of the epoch or something? – terdon Oct 21 '16 at 16:21
  • 3
    @terdon No, they default to the epoch exactly. Just that the epoch is displayed as 31 Dec 1969 in time zones west of Greenwich. – oals Oct 21 '16 at 16:24
  • 2
    @ChrisMerck I've added the origin of the ?. – Stephen Kitt Oct 21 '16 at 18:38
  • 6
    Given the 65535 owner and the 4GB (likely 4294967295) size - the timestamp may similarly be all ones. Since time_t is signed on linux, this gives Dec 31 1969. – namey Oct 21 '16 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.