Version-Release number of selected component (if applicable):
==================================================================
root@server [~]# cat /etc/redhat-release

Red Hat Enterprise Linux ES release 4 (Nahant Update 5)

root@server [~]# uname -a
Linux server.integrityserver.net 2.6.9-55.ELsmp #1 SMP Fri Apr 20 17:03:35 EDT

2007 i686 i686 i386 GNU/Linux
root@server [~]#


How reproducible:
======================

root@server [~]# mkdir 1
mkdir: cannot create directory `1': No such file or directory
root@server
[~]# mkdir 12
mkdir: cannot create directory `12': No such file or directory
root@server [~]# mkdir 1a2
root@server [~]#



Actual results:
======================
mkdir: cannot create directory `1': No such file or directory



Expected results:
======================
should be able to create a directory

Additional Info:
==================
root@server [~]# ll $(which mkdir)
-rwxr-xr-x 1 root root 25060 Sep 19 15:46 /bin/mkdir*

root@server [~]# rpm -qf $(which mkdir)
coreutils-5.2.1-31.6
root@server [~]#
root@server [~]# mount -a
root@server [~]#
root@server [~]#alias | grep mk
root@server [~]#


FSType = ext3




Please advise.


Thanks

That's odd.... I can create folders just fine, i.e. mkdir 1 works.
You are root, so you have permissions, it's not nfs mounted folder, no aliases.... hmmm...
can you create normal folder like "mkdir test1" ? What is the status of "echo $?" after it fails ? Can you use "mkdir -p /path/to/1" ?

Very odd. Could something be wrong with the current directory? Try

I agree... very odd.

Try making a substitute command. With bash or ksh:
function xmkdir { perl -e 'mkdir(shift)' $1 ; }
xmkdir 12

Does that work? What about "mkdir ./12" and "xmkdir ./12"? What about "touch 12"?

Hi,

kernel upgrade fixed the issue

Hi I have the same issue as fed.linuxgossip.

I am running
RHEL AS 4 (Update 5)

Filesystem = ext3

Same Problem:
#########
I can not create numeric files.

I can not create them via anything i can think of, via echo, dd, touch, etc etc.

########

What I can do:

I can write to the same filesystem over NFS on a different machine just fine.

I can boot up off of a Live CD and write to the file system fine.

########
I tried using statically linked binaries like busybox, and I can not create the files.

I updated the system completely to RHEL AS 4 Update 6, (including the kernel), and the problem still persists.

#######
Perderabo :
Changing shells didnt help, nor did quotes or escape characters.

###########

Anything else special you did fed.linuxgossip ?

Does anybody have a copy of the 'mount' binary which was on these systems? Even a copy from backup is fine. I honestly suspect a rootkit being involved in this issue as I have seen it before. Looks like a number of binaries are involved, mount being one of them (due to how early it is called during bootup).

If you do have a copy from these systems, I would recommend you examine the impacted system's from another good kernel and then look for the binaries. You should find the 'mount' binary, another mount binary with what looks like a hash string appended to the end of the name, and then another empty mount file with another hash appended to the name. This seems to be the indicator that the system truly is infected.

Please post the binary to this forum, or PM me if you can supply me with a copy for analysis. I am interested to know if this is the same exact MD5 hash I found or not. Would really like to identify this particular rootkit and get some signatures out there so other people can find it easier.