New files in setuid.today

[Lowell Gilbert]

Andrew Robinson <A.Robinson at ms.unimelb.edu.au> writes:

> I have some new file names in my /var/log/setuid.today file.  There
> are things on an external drive, pdfs, html documents, etc.  The only
> common factor that I can see is that all of them are 's' in the group
> permissions.  An example is:
>
> 1766558 -rw-r-sr--  1 andrewr  andrewr     8076 Jul 24 19:38:17 2005
> /home/andrewr/0.svn/0.infrastructure/www_public/andrewpr.JPG
>
> Just checking the names of the files, I know what each one of them is
> (or is supposed to be!) and none of them are supposed to bne
> executable.
>
> Can anyone tell me how this might happen, and what I should do to
> clean it up?  

The first thing to do is to see whether the contents of the files are
intact or not.  If they are, then I would strongly suspect filesystem
corruption and start trying to clean up on that basis.