Unreferenced files not being deleted
julian at elischer.org
Sun Jan 29 00:07:31 PST 2006
Peter Jeremy wrote:
>On Fri, 2006-Jan-27 06:56:47 +1100, Peter Jeremy wrote:
>>On my recent -current, I've noticed that /var is filling up with
>Updated data point: The files do disappear on a clean shutdown
>so the kernel seems to be aware that they have no name but
>neither fstat nor lsof can find any processes holding them open.
>I have a core dump demonstrating the problem and will poke around
>in it as a background task.
You know it occured to me that a process that is not in the process list
would still work..
could be an easy way to effect a rootkit if one had root access.
wouldn't show up in ps, fstat etc.
it could be another answer to your mystery.. :-/
More information about the freebsd-current