Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a rootkitted SUSE Linux and I'm trying to fix it. I have root privileges but when I go:

cd /etc/init.d
vi rc.sysinit

vi tells me the file is [readonly]. The owner of the file is root.root and the permissions are 0644, so that is ok. Also the partition on which the file resides is mounter as rw and at least any other file in /etc/init.d I can edit.

I also tried:

fuser rc.sysinit
lsof | grep rc.sysinit

but no success. What could be locking the file and how can I "unlock" it? I also have some other locked files like 'ps' and 'netstat' which again I can't overwrite using:

rpm -i --force

The contents of rc.sysinit is:

\#Xntps (NTPv3 daemon) startup..
/usr/sbin/xntps -q

The xntps command is the first thing I need to remove.

share|improve this question
The only way to be sure it's fixed is to nuke and reinstall. – Dennis Williamson Jul 21 '10 at 22:49
up vote 3 down vote accepted

I found what was causing the file to be read only, even for root - the immutable flag.

Running the following did the trick:

chattr -i rc.sysinit
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .