Web lists-archives.com

Re: File with weird permissions, impossible to delete




Hi,

i wrote:
> > What do you get from command stat index.html

Pétùr wrote:
>   File: .cache/shotwell/thumbs/thumbs360/thumb0000000000000c5c.jpg
>  Size: 24576           Blocks: 32         IO Block: 4096   regular file
> Device: 802h/2050d      Inode: 4744568     Links: 1
> Access: (5222/--wS-w--wT)  Uid: (680132648/ UNKNOWN)   Gid: (44094674/
> UNKNOWN)
> Access: 2017-07-08 16:44:21.763005816 +0200
> Modify: 2211-03-27 19:08:40.011012642 +0100
> Change: 2290-05-04 13:52:16.011012642 +0100

Size, Blocks, Links, and Access time look significantly healthy.
"IO Block" too, if it is what man 2 stat has as struct stat.st_blksize.

Device and Inode do not look wrong, at least.
(You could compare Device with the value of a healthy file in the same
 filesystem. They must be identical.)

Uid, Gid, Modify date, and Change date are obviously damaged.

The other file seems to have got hit more completely.


Pétùr wrote:
> > # lsattr .cache/shotwell/thumbs/thumbs360/thumb0000000000000c5c.jpg
> > s---i-d---j--------
> > '.cache/shotwell/thumbs/thumbs360/thumb0000000000000c5c.jpg': Operation
> >  not permitted

Martin wrote:
> Here we see; This thing has the immutable flag set. [...]

Good catch.

man chattr says: secure deletion (s), no dump (d), data journalling (j).
If other files on the same filesystem do not have these flags, then
probably they are garbage, too.
My normal files on ext4 only have the flag "extent format (e)".

Something trampled the parent directory or its attached data structures.


Have a nice day :)

Thomas