up vote 4 down vote favorite
share [g+] share [fb]

I try to chown the owner of a file to root, but I can't. I'm doing this as root. I get the following message:

chown: changing ownership of `ps': Operation not permitted
link|improve this question
An ls -lha and lsattr output would aid the solution :) – AlberT Aug 31 '09 at 10:15
feedback

7 Answers

up vote 18 down vote accepted

The immutable attribute may be set on the file. Remove it with chattr -i

link|improve this answer
2  
It was -a. But thanks for the nod in the right direction. – Peter Stuifzand Aug 31 '09 at 10:14
feedback
up vote 4 down vote

Several solution exists, some among them:

  • you have a filesystem does not lets you eg. uid:gid, eg: FAT
  • the drive has been mounted read-only
  • SELinux or other security enforcers apply
  • filesystem is set to read-only mode (xfs_freeze, for example)
link|improve this answer
Filesystem is ext3, mounted read-write, No SELinux. – Peter Stuifzand Aug 31 '09 at 10:05
It's also possible that the file is on an NFS file system, mounted root_squash, albeit unlikely given the file. – Cian Aug 31 '09 at 10:06
feedback
up vote 2 down vote

Funny. Did you check the system logs (/var/log/messages, /var/log/syslog, output of dmesg) for any clues?

Possible reasons:

  • You are running some security-enhanced Linux, such as SELinux. These place restrictions even on what root can do.
  • The file is on a file system that does not support file ownership, such as (V)FAT. Depending on mount options chmod/chown will give you errors.
link|improve this answer
feedback
up vote 0 down vote

on what kind of Filesystem is the "ps" file you are trying to chown ? Is the fs mounted as ro (readonly) ?

if you are talking about /bin/ps, on debian it's always like:

-rwxr-xr-x 1 root root 76132 2009-05-28 10:48 /bin/ps*
link|improve this answer
The problem is my system was hacked and some files were replaced. Now I want to replace them with the originals but I doesn't work. – Peter Stuifzand Aug 31 '09 at 10:03
8  
If your system was hacked, then you don't want to put files back. You have no way of telling what's been broken, and nothing on the system is trustworthy. Wipe, and reinstall from backups. – Cian Aug 31 '09 at 10:07
1  
As Cian said, if your system was hacked and they got root access, don't replace files. It may still contain a (nearly) invisible rootkit that hijacks system calls. It may still be sniffing passwords, it may still have opened backdoors in your services, and and and (infinite number of possible things a hacked machine may contain). The reasonable thing to do is to turn off the machine and study its contents offline, by putting the disk to another box. Don't trust this machine at all and don't replace any binaries, they may contain valuable information to discover what the rootkit does. – kargig Aug 31 '09 at 11:38
feedback
up vote 0 down vote

Every "guess" made by other answers is possible. A debugging hint may be to do a strace of the command, and look into the output in order to see what is the real problem in the syscalls itself.

strace chown root /bin/ps 2>&1 | less
link|improve this answer
feedback
up vote 0 down vote

Try this:

[root@ root]# chattr -ais /bin/ls

after changing the ownership and group back to root.

Thanks Mukesh Maurya mukesh@pugmarks.com

link|improve this answer
feedback
up vote 0 down vote

I had same problem.

$ chattr -V -i dir
chattr 1.41.12 (17-May-2010)
Flags of dir set as s----a---------

Which was not enough. So i added the 'sa'

$ chattr -V -ais dir
chattr 1.41.12 (17-May-2010)
Flags of dir set as ---------------
$ chown root dir
$

Problem solved :)

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.