On Thu, Mar 06, 2014 at 11:05:20PM +0000, Amit wrote: > 0) After reboot and running 'lsof +L1': > COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME > cupsd 935 root 8r REG 8,1 1392 0 132095 > /etc/passwd (deleted)
So it's reproducible. > 1) Shutting down cups: > sudo service cups stop > > No /etc/passwd in 'lsof +L1' output Since cupsd is the only one who writes in there, and you've just stopped cupsd - that's expected. > 2) Starting cups: > $ sudo /etc/init.d/cups start > [ ok ] Starting cups (via systemctl): cups.service. Oops. That's something I've forgot. I expected sysvinit compatibility layer to take care of cupsd starting. > > 3) No /etc/passwd in 'lsof +L1' output > > 4) fuser output shows cupsd process using /etc/passwd but no output in lsof > showing '(deleted)'. Weird. Just checked again, and on my Wheezy install nobody is using /etc/passwd. Are you running Jessie? > At this point remounting as 'ro' works. As it should be, as nobody is writing to the / filesystem now. As a workaround to all this, you probably can just restart cups on system's boot, and remount '/' read-only after that. As a real solution to the problem, I suggest you to fill a bug report to http://bugs.debian.org Reco -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: https://lists.debian.org/20140307092141.GA26358@x101h