Quote:
Originally Posted by
Corona688
Yikes. Difficult to say without knowing what find found, but a path name with spaces in it may cause unintended splitting whenever unquoted. /path/with /usr/ would split into '/path/with' and '/usr/' for instance.
Why this script was running as root is another good soul-searching question. Preventing program bugs from getting too out of control is one reason file permissions exist, but root bypasses all that.
Well find was intented to return a number;initially 2 and then 3 on the next run,but never more than 3.
And another intresting fact is that the
$oldeest_file sholud only have the filename and not any path.
The script was supposed to be automatically executed by the audomon daemon when the audit trail was swiched to another file.So I have no idead fom where the script was run,but I think the script would hav run with a UID of 0 and thus all the problem.
---------- Post updated at 01:41 AM ---------- Previous update was at 01:37 AM ----------
Quote:
Originally Posted by
Scrutinizer
$oldest_file could also have contained a directory entry. Maybe the script was executed while in the root directory and /usr happened to be the oldest entry..
If that was the case, then all files in
/usr should have been deleted.But some files were not deleted,only a few.