1

I have serious problem when I loged in to my server (Centos5.2-Final) It announced that :

-bash: /bin/egrep: cannot execute binary file
-bash: /bin/egrep: cannot execute binary file
-bash: /bin/egrep: cannot execute binary file
-bash: /bin/hostname: cannot execute binary file
-bash: /bin/grep: cannot execute binary file
-bash: /bin/grep: cannot execute binary file
-bash: /bin/grep: cannot execute binary file
-bash: /bin/grep: cannot execute binary file

The apache and mysql running on this server is work fine but all the execute file in /bin folder have this problem, some of them cannot execute (vi, uname, ps...)

Have anyone met this problem! Please tell me how to solve it !

Improve this question
3
  • what is the output from "which egrep" or "which hostname" or "which grep"?
    – Devin Ceartas
    Sep 21, 2009 at 3:33
  • can you copy (assuming scp works) any of egrep/hostname to sane system and run "file" against them?
    – kolbusa
    Sep 21, 2009 at 4:21
  • @Devin Ceartas : the ouput is : /bin/egrep /bin/grep /bin/hostname @kolbusa : I have only one server ! If I have another one exactly the same may be I'll try to copy the execute file form that server ? Is that possible ?
    – billyduc
    Sep 21, 2009 at 4:39

5 Answers 5

Reset to default
0

Can you please post the following...

ls -l /bin/hostname /bin/egrep /bin/hostname
ldd /bin/hostname /bin/egrep /bin/hostname
file /bin/hostname /bin/egrep /bin/hostname
ls -ld /bin/
echo $SHELL
Improve this answer
6
  • here is my output ; #ls -l /bin/hostname /bin/egrep lrwxrwxrwx 1 root root 4 Jan 2 2008 /bin/egrep -> grep -rwxr-xr-x 1 root root 24200 Sep 20 00:47 /bin/hostname # ldd /bin/hostname /bin/egrep /bin/hostname: not a dynamic executable /bin/egrep: not a dynamic executable # file /bin/hostname /bin/egrep /bin/hostname: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), corrupted program header size, corrupted section header size /bin/egrep: symbolic link to `grep'
    – billyduc
    Sep 21, 2009 at 7:30
  • I think @mitizhi is right : my centos5.2-final is running on Intel Dual Core x86_64 2GHz...but the out put of #file /bin/hostname is AMD x86-64
    – billyduc
    Sep 21, 2009 at 7:33
  • No, that's normal and to be expected. I don't recall the exact historical reasons, but it has something to do with the industry adopting AMD's variant of the 64 bit instruction set.
    – Insyte
    Sep 21, 2009 at 17:46
  • "corrupted program header size" is not good. Did you copy the binaries across from another machine (of a different architecture) by any chance? My guess is not otherwise you'd have mentioned it. If you have another server with the save ARCH/Hardware profile, can you do an md5sum on these corrupted binaries and make sure that they're not identical. I think the safest way, if rpm still works, is to reinstall them if at all possible, you may need to copy over individual files from another server of the same arch/os to be able to to even that though. Interested to see how you go.
    – khosrow
    Sep 22, 2009 at 4:48
  • @Xerxes : thanks for your comment ... I copied the corrupted file from another server with the same arch& hardware via scp and now it's work fine ^^ . Now I'm performing an update entire my server !
    – billyduc
    Sep 22, 2009 at 14:53
1

What is your output of: grep SELINUX /etc/sysconfig/selinux

Chances are SELinux is blocking access.

Improve this answer
1

That is a rootkit ... usualy some rootkits do not require to be compiled. All the files are just replaced . When you are using some i686 Linux those rootkits are installed and anything works perfect but on x86_64 machines you get those errors. You can check /usr/lib/libsh . If this folder is present you have rootkit called shv(4-5) and you will find a folder called backup. In that folder you will find your files like : egrep/hostname/uname/etc. Just copy them and replace /bin files or you can just test them like this : ./hostname . You can reinstall your binutils with yum or get .rpm file and install it manualy. Remember to make backups if you are going to replace manualy.

Improve this answer
0

That error's supposed to be shown for shell scripts without a shebang, so I'm not sure why it'd be shown for those files. I'm wondering if the dynamic linker's gone away, or if the files have been corrupted somehow and they're now full of something else. What does file say they are?

Improve this answer
3
  • file say corrupted program header size, corrupted section header size
    – billyduc
    Sep 21, 2009 at 7:38
  • Your machine is stuffed. Thoroughly test all the hardware, and then reinstall.
    – womble ♦
    Sep 21, 2009 at 8:59
  • Smells like a rootkit.
    – Tom O'Connor
    Dec 3, 2010 at 12:25
0

The bad scenario I can think of is that the files in /bin directory have been corrupted. Another scenario is that the architecture of the ELF files do not match your platform architecture; this could happen if you have x86_64 (64-bit) system but boot with i386 (32-bit) kernel that is incapable of running x86_64 executables.

  1. What is the output of executing "file /bin/grep"
  2. What is the output of "uname -a"
Improve this answer
1
  • # file /bin/grep /bin/grep: ELF 64-bit LSB executable, AMD x86-64, version 1 (SYSV), corrupted program header size, corrupted section header size # uname -a -bash: /bin/uname: cannot execute binary file
    – billyduc
    Sep 21, 2009 at 7:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .