Re: File with weird permissions, impossible to delete

[David Wright]

On Tue 18 Sep 2018 at 16:11:09 (+0200), Pétùr wrote:
> Le 18/09/2018 à 15:46, David Wright a écrit :
> >> How can I delete these files without formating ?
> > To what end? I think you've now got an indication of a problem
> > somewhat more serious than some software dreaming up crazy
> > file permissions and timestamps.
> > 
> > I would now be looking at rescuing everything you can from the drive
> > without prejudicing any backups you already have. Meanwhile I'd be
> > trying to determine the source of this corruption. It's rather
> > worrying that you've had both internal and external drives
> > affected. That's outside my experience.
> 
> It is a external hard drive plugged to another computer than the first
> one with the file corruption problem.
> 
> This corrupted files are from a internal hard drive which was in a dead
> computer. I backup the file and now I just want to clean my external HDD.

Well at least this drive has an excuse for being corrupted. If the
computer died, it may have left the disk in any sort of state.
But I see no reason to change strategy: rescue what you can and then
see what fsck can do. But I'd be unhappy about using the disk without
some thorough checking.

Cheers,
David.

Re: File with weird permissions, impossible to delete

[Pétùr]

Le 18/09/2018 à 15:46, David Wright a écrit :
>> How can I delete these files without formating ?
> To what end? I think you've now got an indication of a problem
> somewhat more serious than some software dreaming up crazy
> file permissions and timestamps.
> 
> I would now be looking at rescuing everything you can from the drive
> without prejudicing any backups you already have. Meanwhile I'd be
> trying to determine the source of this corruption. It's rather
> worrying that you've had both internal and external drives
> affected. That's outside my experience.

It is a external hard drive plugged to another computer than the first
one with the file corruption problem.

This corrupted files are from a internal hard drive which was in a dead
computer. I backup the file and now I just want to clean my external HDD.

Pétùr

Re: File with weird permissions, impossible to delete

[David Wright]

On Tue 18 Sep 2018 at 14:56:53 (+0200), Pétùr wrote:
> Le 11/09/2018 à 13:52, Pétùr a écrit :
> > I have some files, with weird permissions:
> > 
> > # ls -la
> > d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 index.html
> > 
> > Cannot delete, cannot change owner or group (what is this user
> > 1061270772 and group 2605320832 by the way?) even for root.
> > 
> > How can I get rid of these?
> > 
> > Pétùr
> > 
> 
> Another example of weird permissions today for a file on an external
> hard drive (ntfs)
> 
> # ll
> ls: cannot access 'Western_Europe.zip': No such file or directory
> total 21
> -rwxrwxrwx 1 petur petur   228 Mar 31  2010 activation_map_51183.cab
> -rwxrwxrwx 1 petur petur 10410 Mar 31  2010 map14655-1.gif
> -rwxrwxrwx 1 petur petur  1737 Mar 31  2010 map14655.gif
> -? ? ?  ?  ?? Western_Europe.zip
> -rwxrwxrwx 1 petur petur  3236 Mar 31  2010 We풦tern_Europe.toc
> 
> # rm -rfv *
> rm: cannot remove 'activation_map_51183.cab': Input/output error
> rm: cannot remove 'map14655-1.gif': Input/output error
> rm: cannot remove 'map14655.gif': Input/output error
> 
> 
> How can I delete these files without formating ?

To what end? I think you've now got an indication of a problem
somewhat more serious than some software dreaming up crazy
file permissions and timestamps.

I would now be looking at rescuing everything you can from the drive
without prejudicing any backups you already have. Meanwhile I'd be
trying to determine the source of this corruption. It's rather
worrying that you've had both internal and external drives
affected. That's outside my experience.

Cheers,
David.

Re: File with weird permissions, impossible to delete

[Pétùr]

Le 11/09/2018 à 13:52, Pétùr a écrit :
> I have some files, with weird permissions:
> 
> # ls -la
> d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 index.html
> 
> Cannot delete, cannot change owner or group (what is this user
> 1061270772 and group 2605320832 by the way?) even for root.
> 
> How can I get rid of these?
> 
> Pétùr
> 

Another example of weird permissions today for a file on an external
hard drive (ntfs)

# ll
ls: cannot access 'Western_Europe.zip': No such file or directory
total 21
-rwxrwxrwx 1 petur petur   228 Mar 31  2010 activation_map_51183.cab
-rwxrwxrwx 1 petur petur 10410 Mar 31  2010 map14655-1.gif
-rwxrwxrwx 1 petur petur  1737 Mar 31  2010 map14655.gif
-? ? ?  ?  ?? Western_Europe.zip
-rwxrwxrwx 1 petur petur  3236 Mar 31  2010 We풦tern_Europe.toc

# rm -rfv *
rm: cannot remove 'activation_map_51183.cab': Input/output error
rm: cannot remove 'map14655-1.gif': Input/output error
rm: cannot remove 'map14655.gif': Input/output error


How can I delete these files without formating ?

Re: File with weird permissions, impossible to delete

[Zenaan Harkness]

On Tue, Sep 11, 2018 at 09:21:50PM -0400, Gene Heskett wrote:
> On Tuesday 11 September 2018 19:13:58 Ben Caradoc-Davies wrote:
> 
> > On 12/09/2018 00:59, Greg Wooledge wrote:
> > > On Tue, Sep 11, 2018 at 01:52:15PM +0200, Pétùr wrote:
> > >> I have some files, with weird permissions:
> > >> # ls -la
> > >> d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 index.html
> > >
> > > Obvious file system corruption.  Unmount, fsck, re-mount, and then
> > > be prepared to restore the data from your last good backup if/when
> > > the fsck failed to repair everything.
> >
> > I would also use journalctl to look for any i/o errors on the affected
> > device.
> >
> > What hardware and kernel and filesystem? ext4 filesystem corruption is
> > rare and usually suggests a hardware fault.
> >
> > I would run a full hardware test, including CPU and RAM, and a long
> > SMART test on the storage if it is capable. SMART self-tests will not
> > usually detect drive data transmission errors caused by cable
> > problems, but the SMART logs should list the CRC error count which can
> > indicate unreliable cables or controller connectors.
> >
> > I would first identify the *cause* and replace all unreliable hardware
> > before bothering to restore from backup. If you have noticed some
> > corruption, you likely also have some unnoticed corruption. Continuing
> > to use unreliable hardware wastes your time and endangers your data.
> >
> > Kind regards,
> 
> I will 2nd and 3rd Bens advice. Bad cables have been the huge majority of 
> such nefarious goings on. Particularly if they are bright red and 4+ 
> years old, put a tail on the log, and prod the cable gently with a 
> wooden pencil.  If the log blows up, bad cable, replace it with any 
> color but red. Preferably a month ago...

zfs ftw (although there's still a need for a "read back every block
written, and double check its hash, before committing" which is a
requested feature hopefully soon in the works (for those who can
stomach the ACK latency involved).

zfs is still more certain than everything else available, even
without the above feature.

zfs "scrubbing" (around since dot) gives a time-delay version of this
feature, which is insufficient for the truly paranoid, or for those
struggling with intermittently bad cables.

Good luck,



Here's the feature request, subscribe (or add a heart or thumbs up to
the original post in the thread) to voice your interest:

Verify disks writes #2526
https://github.com/zfsonlinux/zfs/issues/2526

Re: File with weird permissions, impossible to delete

[Pétùr]

Le 12/09/2018 à 01:43, Felix Miata a écrit :
>> I deleted the file 
>> .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg
> Deleted exactly how?

`rm -vf` in root

>> without issue after chattr -i on this file.
>> However, it didn't work for the index.html file which is considered as a 
>> folder.
> Exactly how did you try?

`rm -rvf` in root

Re: File with weird permissions, impossible to delete

[Gene Heskett]

On Tuesday 11 September 2018 19:13:58 Ben Caradoc-Davies wrote:

> On 12/09/2018 00:59, Greg Wooledge wrote:
> > On Tue, Sep 11, 2018 at 01:52:15PM +0200, Pétùr wrote:
> >> I have some files, with weird permissions:
> >> # ls -la
> >> d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 index.html
> >
> > Obvious file system corruption.  Unmount, fsck, re-mount, and then
> > be prepared to restore the data from your last good backup if/when
> > the fsck failed to repair everything.
>
> I would also use journalctl to look for any i/o errors on the affected
> device.
>
> What hardware and kernel and filesystem? ext4 filesystem corruption is
> rare and usually suggests a hardware fault.
>
> I would run a full hardware test, including CPU and RAM, and a long
> SMART test on the storage if it is capable. SMART self-tests will not
> usually detect drive data transmission errors caused by cable
> problems, but the SMART logs should list the CRC error count which can
> indicate unreliable cables or controller connectors.
>
> I would first identify the *cause* and replace all unreliable hardware
> before bothering to restore from backup. If you have noticed some
> corruption, you likely also have some unnoticed corruption. Continuing
> to use unreliable hardware wastes your time and endangers your data.
>
> Kind regards,

I will 2nd and 3rd Bens advice. Bad cables have been the huge majority of 
such nefarious goings on. Particularly if they are bright red and 4+ 
years old, put a tail on the log, and prod the cable gently with a 
wooden pencil.  If the log blows up, bad cable, replace it with any 
color but red. Preferably a month ago...

 

-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page 

Re: File with weird permissions, impossible to delete

[Felix Miata]

Pétùr composed on 2018-09-11 19:45 (UTC+0200):

> Martin composed:

>> don't get crazy about FS corruption. There is no sign this is the case so
>> far. Date and UID's are odd, but valid within ext4. Remove the immutable
>> flag (chattr -i), you will be able to alter the files as you like.

>> One hint will be, check if your system time is ok (both, date and
>> hwclock!), may be there is a reason for this odd timestamps.

> Thanks for the reassuring words.

> I deleted the file 
> .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg

Deleted exactly how?

> without issue after chattr -i on this file.

> However, it didn't work for the index.html file which is considered as a 
> folder.

Exactly how did you try?

> # ls -la .local/share/Trash/expunged/1257950219/ 
> myfolder/files/fullsize/index.html total 16 d-wS--S--T 2 1061270772
> 2605320832  4096 oct.   7  2412 . drwx-- 3 petur petur 12288
> avril 25 12:21 ..

If by delete you really mean move to trash using some GUI file manager, likely
the trash system will not accept the corruption. :-p

Have you ever tried using the F8 key in Midnight Commander?
-- 
"Wisdom is supreme; therefore get wisdom. Whatever else you
get, get wisdom." Proverbs 4:7 (New Living Translation)

 Team OS/2 ** Reg. Linux User #211409 ** a11y rocks!

Felix Miata  ***  http://fm.no-ip.com/

Re: File with weird permissions, impossible to delete

[Ben Caradoc-Davies]

On 12/09/2018 00:59, Greg Wooledge wrote:

On Tue, Sep 11, 2018 at 01:52:15PM +0200, Pétùr wrote:

I have some files, with weird permissions:
# ls -la
d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 index.html

Obvious file system corruption.  Unmount, fsck, re-mount, and then
be prepared to restore the data from your last good backup if/when
the fsck failed to repair everything.


I would also use journalctl to look for any i/o errors on the affected 
device.


What hardware and kernel and filesystem? ext4 filesystem corruption is 
rare and usually suggests a hardware fault.


I would run a full hardware test, including CPU and RAM, and a long 
SMART test on the storage if it is capable. SMART self-tests will not 
usually detect drive data transmission errors caused by cable problems, 
but the SMART logs should list the CRC error count which can indicate 
unreliable cables or controller connectors.


I would first identify the *cause* and replace all unreliable hardware 
before bothering to restore from backup. If you have noticed some 
corruption, you likely also have some unnoticed corruption. Continuing 
to use unreliable hardware wastes your time and endangers your data.


Kind regards,

--
Ben Caradoc-Davies 
Director
Transient Software Limited 
New Zealand

Re: File with weird permissions, impossible to delete

[David Wright]

On Tue 11 Sep 2018 at 19:34:53 (+0200), Martin wrote:
> Pétùr,
> 
> don't get crazy about FS corruption. There is no sign this is the case so 
> far. Date and UID's are odd, but valid within ext4. Remove the immutable flag 
> (chattr -i), you will be able to alter the files as you like.
> 
> One hint will be, check if your system time is ok (both, date and hwclock!), 
> may be there is a reason for this odd timestamps.

Please stop posting this bad advice. Applying sticking plaster does
not help a puncture wound ± an internal hemorrhage.

Cheers,
David.

Re: File with weird permissions, impossible to delete

[Joe Pfeiffer]

Pétùr  writes:

> Le 11/09/2018 à 19:34, Martin a écrit :
>>
>> don't get crazy about FS corruption. There is no sign this is the
>> case so far. Date and UID's are odd, but valid within ext4. Remove
>> the immutable flag (chattr -i), you will be able to alter the files
>> as you like.
>>
>> One hint will be, check if your system time is ok (both, date and
>> hwclock!), may be there is a reason for this odd timestamps.
>
> Thanks for the reassuring words.
>
> I deleted the file
> .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg
>
> without issue after chattr -i on this file.
>
> However, it didn't work for the index.html file which is considered as
> a folder.
>
>
> # ls -la .local/share/Trash/expunged/1257950219/
> myfolder/files/fullsize/index.html
> total 16
> d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 .
> drwx-- 3 petur petur 12288 avril 25 12:21 ..

I realize you've almost certainly already thought of this, but I sort of
have to point it out -- did you try using rmdir?

Re: File with weird permissions, impossible to delete

[mick crane]

On 2018-09-11 18:45, Pétùr wrote:

Le 11/09/2018 à 19:34, Martin a écrit :


don't get crazy about FS corruption. There is no sign this is the case 
so far. Date and UID's are odd, but valid within ext4. Remove the 
immutable flag (chattr -i), you will be able to alter the files as you 
like.


One hint will be, check if your system time is ok (both, date and 
hwclock!), may be there is a reason for this odd timestamps.


Thanks for the reassuring words.

I deleted the file 
.cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg


without issue after chattr -i on this file.

However, it didn't work for the index.html file which is considered as 
a folder.



# ls -la .local/share/Trash/expunged/1257950219/
myfolder/files/fullsize/index.html
total 16
d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 .
drwx-- 3 petur petur 12288 avril 25 12:21 ..


what about moving everything else in full size somewhere and then rm -rf 
/path_to/fullsize ?



mick
--
Key ID4BFEBB31

Re: File with weird permissions, impossible to delete

[Michael Stone]

On Tue, Sep 11, 2018 at 07:34:53PM +0200, Martin wrote:
don't get crazy about FS corruption. There is no sign this is the case 
so far.


umm, yeah, this is pretty classic. it's more likely than not that random 
bits will result in file attributes that can be interpreted but are 
completely bogus.


One hint will be, check if your system time is ok (both, date and 
hwclock!), may be there is a reason for this odd timestamps.


there's basically zero chance that setting the clock wrong would result 
in timestamps that are 200 and 270 years in the future on a single file.


Mike Stone

Re: File with weird permissions, impossible to delete

[Pétùr]

Le 11/09/2018 à 19:34, Martin a écrit :


don't get crazy about FS corruption. There is no sign this is the case so far. 
Date and UID's are odd, but valid within ext4. Remove the immutable flag 
(chattr -i), you will be able to alter the files as you like.

One hint will be, check if your system time is ok (both, date and hwclock!), 
may be there is a reason for this odd timestamps.


Thanks for the reassuring words.

I deleted the file 
.cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg


without issue after chattr -i on this file.

However, it didn't work for the index.html file which is considered as a 
folder.



# ls -la .local/share/Trash/expunged/1257950219/
myfolder/files/fullsize/index.html
total 16
d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 .
drwx-- 3 petur petur 12288 avril 25 12:21 ..

Re: File with weird permissions, impossible to delete

[Martin]

Pétùr,

don't get crazy about FS corruption. There is no sign this is the case so far. 
Date and UID's are odd, but valid within ext4. Remove the immutable flag 
(chattr -i), you will be able to alter the files as you like.

One hint will be, check if your system time is ok (both, date and hwclock!), 
may be there is a reason for this odd timestamps.

[...]

> 
> Thanks everyone for the output.
> 
> I have theses two files for quite some time now and the system is working 
> great without any issue.
> 
> Maybe these files were generated by a power shutdown or by a partition full 
> (my machine was not rebooting correctly sometimes ago because a script fills 
> out all the space available).
> 
> The permissions of the folders of the corrupt files are normal.
> 
> I will make some backup, then try fsck and leave the corrupted files if fsck 
> doesn't get rid of them, maybe reformate later.
> 
> Pétùr
> 

Re: File with weird permissions, impossible to delete

[Michael Stone]

On Tue, Sep 11, 2018 at 09:49:32AM -0600, Joe Pfeiffer wrote:

"Thomas Schmitt"  writes:

Something trampled the parent directory or its attached data structures.


It appears to be the two inodes, not the parent directory, that got
trampled.


The problem is that it's fairly unlikely that two inodes in two 
different directories got trashed, and nothing else.


Mike Stone

Re: File with weird permissions, impossible to delete

[Joe Pfeiffer]

"Thomas Schmitt"  writes:
>
> Something trampled the parent directory or its attached data structures.

It appears to be the two inodes, not the parent directory, that got
trampled.

Re: File with weird permissions, impossible to delete

[Pétùr]

Le 11/09/2018 à 16:44, Michael Stone a écrit :

On Tue, Sep 11, 2018 at 08:59:56AM -0400, Greg Wooledge wrote:

On Tue, Sep 11, 2018 at 01:52:15PM +0200, Pétùr wrote:

I have some files, with weird permissions:

# ls -la
d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 index.html


Obvious file system corruption.  Unmount, fsck, re-mount, and then
be prepared to restore the data from your last good backup if/when
the fsck failed to repair everything.


+1, except that fsck is not likely to help and you should probably move 
right to backups. (looking through the backups to find out when the 
corruption started...)


Mike Stone



Thanks everyone for the output.

I have theses two files for quite some time now and the system is 
working great without any issue.


Maybe these files were generated by a power shutdown or by a partition 
full (my machine was not rebooting correctly sometimes ago because a 
script fills out all the space available).


The permissions of the folders of the corrupt files are normal.

I will make some backup, then try fsck and leave the corrupted files if 
fsck doesn't get rid of them, maybe reformate later.


Pétùr

Re: File with weird permissions, impossible to delete

[Thomas Schmitt]

Hi,

i wrote:
> > What do you get from command stat index.html

Pétùr wrote:
>   File: .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg
>  Size: 24576   Blocks: 32 IO Block: 4096   regular file
> Device: 802h/2050d  Inode: 4744568 Links: 1
> Access: (5222/--wS-w--wT)  Uid: (680132648/ UNKNOWN)   Gid: (44094674/
> UNKNOWN)
> Access: 2017-07-08 16:44:21.763005816 +0200
> Modify: 2211-03-27 19:08:40.011012642 +0100
> Change: 2290-05-04 13:52:16.011012642 +0100

Size, Blocks, Links, and Access time look significantly healthy.
"IO Block" too, if it is what man 2 stat has as struct stat.st_blksize.

Device and Inode do not look wrong, at least.
(You could compare Device with the value of a healthy file in the same
 filesystem. They must be identical.)

Uid, Gid, Modify date, and Change date are obviously damaged.

The other file seems to have got hit more completely.


Pétùr wrote:
> > # lsattr .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg
> > s---i-d---j
> > '.cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg': Operation
> >  not permitted

Martin wrote:
> Here we see; This thing has the immutable flag set. [...]

Good catch.

man chattr says: secure deletion (s), no dump (d), data journalling (j).
If other files on the same filesystem do not have these flags, then
probably they are garbage, too.
My normal files on ext4 only have the flag "extent format (e)".

Something trampled the parent directory or its attached data structures.


Have a nice day :)

Thomas

Re: File with weird permissions, impossible to delete

[Michael Stone]

On Tue, Sep 11, 2018 at 08:59:56AM -0400, Greg Wooledge wrote:

On Tue, Sep 11, 2018 at 01:52:15PM +0200, Pétùr wrote:

I have some files, with weird permissions:

# ls -la
d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 index.html


Obvious file system corruption.  Unmount, fsck, re-mount, and then
be prepared to restore the data from your last good backup if/when
the fsck failed to repair everything.


+1, except that fsck is not likely to help and you should probably move 
right to backups. (looking through the backups to find out when the 
corruption started...)


Mike Stone

Re: File with weird permissions, impossible to delete

[David Wright]

On Tue 11 Sep 2018 at 14:48:45 (+0200), Pétùr wrote:
> I have two files with this problem.
> 
> The first one (index.html) which is considered as directory is in
> .local/share/Trash/expunged
> 
> and the second one is a thumb of shotwell:
> 
> $ ls -la .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg
> --wS-w--wT 1 680132648 44094674 24576 mars  27  2211
> .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg

It looks as if they're both on /home. Do you have /home mounted as a
separate partition? If so, then then damage (which is what I think it
is) may be limited to there. If so, I would treat anything in /home as
potentially suspect.

What to do next might well depend on how well your files are backed
up. I would take a copy of the partition as it stands, then fsck it
and see how much damage that finds. At that point you would need to
decide whether to live with the fsck'd partition or to reformat it and
restore from backups.

If you reformat/restore, you could then check out the files on the
copy that have dates younger than the backup and, if happy with their
integrity, copy them back.

All in all, I think you should concentrate on ascertaining the
integrity of the rest of your files before assuming that deleting
two of them will make things hunky dory adagin. And it does seem more
likely to me that the cause of the problem is your system rather than
an unsatisfactory router.

Cheers,
David.

Re: File with weird permissions, impossible to delete

[Martin]

Am 11.09.2018 um 14:48 schrieb Pétùr:
> I have two files with this problem.
> 
> The first one (index.html) which is considered as directory is in
> .local/share/Trash/expunged
> 
> and the second one is a thumb of shotwell:
> 
> $ ls -la .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg
> --wS-w--wT 1 680132648 44094674 24576 mars  27  2211
> .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg
> 
> Le 11/09/2018 à 14:27, Martin a écrit :
>> What file system?
> 
> ext4
> 
>> What does 'lsattr' say?
> 
> # lsattr .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg
> s---i-d---j
> .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg

Here we see; This thing has the immutable flag set. This is a part of (not 
only) ext4's acl implementation.
See man pages of lsattr and chattr.
Use 'sudo chattr -i [file]' to remove that flag.

> 
>> rm
> 
[...]

Re: File with weird permissions, impossible to delete

[Greg Wooledge]

On Tue, Sep 11, 2018 at 01:52:15PM +0200, Pétùr wrote:
> I have some files, with weird permissions:
> 
> # ls -la
> d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 index.html

Obvious file system corruption.  Unmount, fsck, re-mount, and then
be prepared to restore the data from your last good backup if/when
the fsck failed to repair everything.

Re: File with weird permissions, impossible to delete

[Erik Christiansen]

On 11.09.18 13:52, Pétùr wrote:
> I have some files, with weird permissions:
> 
> # ls -la
> d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 index.html

OK, you have the suid, sgid, and sticky bits set, and it's a directory.
Execute (directory navigate) permission is off.

> Cannot delete, cannot change owner or group (what is this user
> 1061270772 and group 2605320832 by the way?) even for root.

Linux supports 32 bit uids and gids, so those numbers seem OK.
The blockage will be the sticky bit, if your effective UID is not root. 

> How can I get rid of these?

I'd also check that the filesystem is not mounted "noexec", and please
post the permissions on the parent directory, as its ownership and
permissions are just as relevant as what is shown.

Erik

Re: File with weird permissions, impossible to delete

[Pétùr]

I have two files with this problem.

The first one (index.html) which is considered as directory is in
.local/share/Trash/expunged

and the second one is a thumb of shotwell:

$ ls -la .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg
--wS-w--wT 1 680132648 44094674 24576 mars  27  2211
.cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg

Le 11/09/2018 à 14:27, Martin a écrit :
> What file system?

ext4

> What does 'lsattr' say?

# lsattr .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg
s---i-d---j
.cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg

> rm

# rm -fvr .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg
rm: cannot remove
'.cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg': Operation
not permitted

(the same for chown)

> What do you get from command stat index.html

 stat .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg
  File: .cache/shotwell/thumbs/thumbs360/thumb0c5c.jpg
  Size: 24576   Blocks: 32 IO Block: 4096   regular file
Device: 802h/2050d  Inode: 4744568 Links: 1
Access: (5222/--wS-w--wT)  Uid: (680132648/ UNKNOWN)   Gid: (44094674/
UNKNOWN)
Access: 2017-07-08 16:44:21.763005816 +0200
Modify: 2211-03-27 19:08:40.011012642 +0100
Change: 2290-05-04 13:52:16.011012642 +0100
 Birth: -

Re: File with weird permissions, impossible to delete

[Thomas Schmitt]

Hi,

Pétùr wrote:
> > d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 index.html

to...@tuxteam.de wrote:
> Whoa. 'S' is a setuid file which is not executable. Exotic, to say
> the least.

Not to speak of the year 2412, and "index.html" being a directory.


> Perhaps you are dealing with file system corruption.

This looks like the inode is filled with garbage. 

To Pétùr:
What do you get from command
  stat index.html

and what error message do you get from attempts to chmod or chown the file ?


Have a nice day :)

Thomas

Re: File with weird permissions, impossible to delete

[Gene Heskett]

On Tuesday 11 September 2018 07:52:15 Pétùr wrote:

> I have some files, with weird permissions:
>
> # ls -la
> d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 index.html
>
> Cannot delete, cannot change owner or group (what is this user
> 1061270772 and group 2605320832 by the way?) even for root.
>
> How can I get rid of these?
>
> Pétùr

Need more info, but gut reaction says to reformat and re-install. And put 
a copy of dd-wrt in a decent router between you and the net.  Best guard 
dog ever, never sleeps.

-- 
Cheers, Gene Heskett
--
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Genes Web page 

Re: File with weird permissions, impossible to delete

[tomas]

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Tue, Sep 11, 2018 at 01:52:15PM +0200, Pétùr wrote:
> I have some files, with weird permissions:
> 
> # ls -la
> d-wS--S--T 2 1061270772 2605320832  4096 oct.   7  2412 index.html

Whoa. 'S' is a setuid file which is not executable. Exotic, to say
the least. Perhaps you are dealing with file system corruption.

Do you have a backup?

> Cannot delete, cannot change owner or group (what is this user
> 1061270772 and group 2605320832 by the way?) even for root.

The UID and GID are pretty strange too.

The error message (when you try to delete it) would be interesting.

Cheers
- -- tomás
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAluXrlsACgkQBcgs9XrR2kbMCQCeKDoR5jOQL1LI1+hjYJ6O/SN/
8vwAnjZeeoC1fn9A6chfzF4Z8yLoAXJa
=G1g5
-END PGP SIGNATURE-