Subject: Re: Can't remove munged file
To: Larry Kollar <Larry.Kollar@arris-i.com>
From: Dr. Bill Studenmund <wrstuden@loki.stanford.edu>
List: port-mac68k
Date: 09/08/1998 15:40:45
On Tue, 8 Sep 1998, Larry Kollar wrote:

> Only the /home partition got corrupted, and it took fsck two
> passes to find all the problems.  However, two files got so
> completely trashed that they look like devices.  Worse, I can't
> do ***anything*** to them -- mv (rename or to another dir),
> rm -f, chmod, chown, all return "Operation not permitted."
> This happens even in single-user mode.

I think you've encountered the joy of append-only files. I ran into this
recently, and do not look forward to fixing things.

Basicly there are some sttributes to a file which you can set which make
it impossible for root to rename or delete, etc, a file. Also, the file
can be made append only, even for root. The idea is that root can be
prevented from deleting files, so for instance a root attack can't
delete log files. :-) These flags can only be removed when in single user
mode.

To be honest, I don't know how to delete them. But you can find out if
it's the case by typing ls -lo. Here's the output from my demon file:

-rw-r--r--  1 wrstuden  users  uappnd,uchg 97792 Sep  4 11:29 /y6/demonfile
                               ^^^^^^^^^^^ these are the attributes
					   I'm talking about.
Here's a normal file w/ ls -lo
-rw-r--r--  1 wrstuden  users  - 1643 Nov  8  1997 ~/normal

Take care,

Bill