Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a rootkitted SUSE Linux and I'm trying to fix it. I have root privileges but when I go:

cd /etc/init.d
vi rc.sysinit

vi tells me the file is [readonly]. The owner of the file is root.root and the permissions are 0644, so that is ok. Also the partition on which the file resides is mounter as rw and at least any other file in /etc/init.d I can edit.

I also tried:

fuser rc.sysinit
lsof | grep rc.sysinit

but no success. What could be locking the file and how can I "unlock" it? I also have some other locked files like 'ps' and 'netstat' which again I can't overwrite using:

rpm -i --force

The contents of rc.sysinit is:

\#Xntps (NTPv3 daemon) startup..
/usr/sbin/xntps -q

The xntps command is the first thing I need to remove.

share|improve this question
    
The only way to be sure it's fixed is to nuke and reinstall. –  Dennis Williamson Jul 21 '10 at 22:49

1 Answer 1

up vote 3 down vote accepted

I found what was causing the file to be read only, even for root - the immutable flag.

Running the following did the trick:

chattr -i rc.sysinit
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.