How do I fix a "still dirty" filesystem?

[Jo Root]

On Mon, 25 Oct 1999, Paul Richards wrote:
> Jo & wrote:
> > 
> > I think I'm in deep trouble.
> > 
> > I was innocently unarchiving an innocent archive (whose contents I'd checked
> > first) into my '/' directory, and then the unarchiving process bombed out (with
> > 'unexpected end of archive' or somesuch), and before I know it, I find that I'm
> > seemingly unable to do anything in the windows where I am my mortal self:
> > commands such as pwd and ls fail, and so on. (root seems unaffected).
> 
> Point number one is, don't unarchive over '/' when not single user and
> even then you need to be careful. Really, you should only do that on an
> idle filesystem, i.e. one you've mounted somewhere else to do
> maintenance on, not one that the system is actually running off.

oops.. :-(
  
> > Fearing something nasty has happened, I reboot and run fsck.
> > After each partition is checked, I get:
> > 
> > ***** FILE SYSTEM STILL DIRTY *****
> > 
> > ***** PLEASE RERUN FSCK *****
> > 
> > I've rerun fsck 3 or 4 times, and things aren't looking any happier.
> 
> I'm guessing you're running fsck on mounted filesystems, don't do that!

Ah, do I _have_ to be in single user mode to run fsck?

The FreeBSD 3.2 boot system has changed from older versions (and doesn't seem
to be as helpful, IMO). In the colder light of day, I tried to boot single user
by pressing <space> at the "Loading kernel in n seconds.." prompt, and then
typing  boot -s  (which seemingly still does what it used to).

running fsck from the single user root prompt, fsck seems happy, and seems to
think it's fixed the problems.
  
> If you've rebooted and the system has come up multi-user then you're
> filesystems are all ok. If you shutdown cleanly then I suspect
> everything is fine. If they weren't the boot would have bombed out when
> the fsck runs from /etc/rc

I've then rebooted, (bootup fsck describes file systems as 'clean, not
checking' and seems happy), BUT again I can't login as a mortal user or su to a
mortal from root (and 'man' still doesn't work, with the same error as before,
etc).



> > 
> > ls and pwd work fine as root (as do other things, eg KDE, and kmail, thankfully)
> > but for some reason 'man' seems knackered:
> > 
> > gatehouse# man
> > /usr/libexec/ld-elf.so.1: Cannot open "/usr/lib/libc.so.3"
> 
> Is it there? What are the permissions.

Both there:

gatehouse# ll /usr/libexec/ld-elf.so.1
-r-xr-xr-x  1 root  wheel  63652 May 18 04:39 /usr/libexec/ld-elf.so.1*  

gatehouse# ll /usr/lib/libc.so.3
-r--r--r--  1 root  wheel  514015 May 18 04:37 /usr/lib/libc.so.3   

(Should this file be executable?)

 
> What was in this "innocent" archive of yours? 

It was the xfmail-1.3.8-1.tgz archive from http://xfmail.ufies.org/unstable/

It contains:

gatehouse# tar zvtf /home/dm/portdists/xfmail-1.3.8-1.tgz
drwx------ root/root         0 Oct 24 02:56 1999 ./
drwxr-xr-x root/root         0 Oct 24 02:56 1999 ./usr/
drwxr-xr-x root/root         0 Oct 24 02:56 1999 ./usr/X11R6/
drwxr-xr-x root/root         0 Oct 24 02:56 1999 ./usr/X11R6/bin/
-rwxr-xr-x root/root    933872 Oct 24 02:54 1999 ./usr/X11R6/bin/xfmail
drwxr-xr-x root/root         0 Oct 24 02:56 1999 ./usr/X11R6/man/
drwxr-xr-x root/root         0 Oct 24 02:56 1999 ./usr/X11R6/man/man1/
-rw-r--r-- root/root      1412 Oct 24 02:54 1999 ./usr/X11R6/man/man1/xfmail.1x.bz2
drwxr-xr-x root/root         0 Oct 24 02:56 1999 ./usr/doc/
drwxr-xr-x root/root         0 Oct 24 02:56 1999 ./usr/doc/xfmail-1.3.8/
-rw-r--r-- root/root      9436 Oct 24 02:46 1999 ./usr/doc/xfmail-1.3.8/ChangeLog
-rw-r--r-- root/root      2460 Oct 24 02:46 1999 ./usr/doc/xfmail-1.3.8/Copyright
-rw-r--r-- root/root      2745 Oct 24 02:46 1999 ./usr/doc/xfmail-1.3.8/KNOWNBUGS
-rw-r--r-- root/root     14412 Oct 24 02:46 1999 ./usr/doc/xfmail-1.3.8/README
-rw-r--r-- root/root       730 Oct 24 02:46 1999 ./usr/doc/xfmail-1.3.8/TODO       


The only weird thing I spotted there was the slightly out of place (probably a
linux thing) /usr/doc/ dir which doesn't seem to contain anything harmful..

(Oh, hang on, should the permissions on '/' be as above?
That's what mine is now (except root:wheel instead))


> It looks like you've blown
> away some important system files but I'd need a lot more info to sort it
> out. I doubt very much that your system is totally hosed so don't do
> anything rash to the box until one of us here can guide you out of the
> mess.

Many thanks for any help!

> Take a look at what the archive overwrote, that will be the key; examine
> all your /etc files and lib directories and check that everything is as
> it should be.

What's the best way of doing this?
Doing a find for modification dates, and then taking a look at those files
found?


As far as I can see, the archive shouldn't have overwritten anything crucial
(apart from my existing xfmail binary, which was the whole point..)

Unless it actually *has* overwritten the (uhh?) inode entries for /, /usr and so
on, in which case, I am in deep, aren't I?  :-(


> If you need more help then you'll have to provide *exact* error
> messages, "something like that" doesn't really help.

Sorry about that. It was late at night when I posted, and, I'm sorry to say,
had committed the cardinal sin of 'one last small hack before bed' after going
to the pub.. I won't be doing that again.

I will try to post error messages exactly as I get them, if needed.


Thanks,


David.

--
David Marsh,drmarsh at bigfoot.com   | http://www.viewport.co.uk/            |
Glasgow/Glaschu, Scotland.        | If urgent, phone: +44 77-121-848-90   |
    (If I'm sending mail as root, you know I'm really in big trouble..)    
> Trim quotes b4 replying / Quote 1st, reply 2nd / Ask b4 attaching files <