0

I have this peculiar problem, which I hope some one can help me to solve it.

I use xubuntu 20.05, up to date (on Asus prime x470-pro MB, BIOS V5843)

Every time I login, there is a popup requesting for authentication, saying: An application is attempting to perform an action ...

Investigation showed that there is a file in /tmp with this contents:

#!/bin/bash
chown -h -R 1000 "/home/jw/Dropbox"
chmod  -R u+rwX "/home/jw/Dropbox"
echo Done

In spite of numerous greps and finds I was not able to trace its source. Deleting this file removes the request and cancelling the request removes the file in /tmp.

In auth.log there are corresponding lines like:

pkexec: jw: Error executing command as another user:
Request dismissed [USER=root] [TTY=unknown] [CWD=/home/jw]
[COMMAND=/bin/sh /tmp/tmp0b3kwgk6]: 1 Time(s)

Now I do remember vaguely that long ago under bionic 18.04, I had some problems syncing Dropbox files that belonged to another user, but I do not remember the details of its invocation. These popups appeared also before, under bionic.

I was surprised (and annoyed) to see them also in focal. Today I purged all dropbox software and made a fresh install, to no avail.

I inspected all crontabs and initramfs, also to no avail.

Last hope is to get a pointer from the community.

3
  • 1
    you could search the whole drive for the text echo Done ... you could get lucky and find the program that creates that tmp file – jsotola Jun 10 at 23:57
  • Well, of course I did. As well as for other pieces of text in there. Really nobody has an idea what could have caused this behaviour? – Jack Jun 12 at 6:23
  • I ran find /DIR -type f -exec grep -Iq 'chown -h -R 1000' {} \; -print 2>/dev/null for all dirs except /dev, /proc and the like. This finds the file in /tmp as well as other places where I just mentioned chown -h -R 1000 (e.g. in an email and my personal file with collected problems). The conclusion is: It must be hidden in a binary file! Right? – Jack Jun 12 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.