Re: real and effective user ids must match

On Thu, Sep 14, 2006 at 10:24:29PM -0700, Jeff Frost wrote:
> On Thu, 14 Sep 2006, Michael Fuhr wrote:
> >Can anybody else with a Linux box test the above command?
>
> On my FC4 machine running 2.6.16-1.2111_FC4:
>
> uid=26(postgres) gid=26(postgres) groups=26(postgres)
> context=user_u:system_r:unconfined_t

That's what I'd expect.  David's box appears to be behaving oddly,
which could be signs of tampering if he has indeed been hacked.  If
that's happened then commands like "ls" and "ps" can't be trusted.

Can anybody think of a way for David to be seeing the behavior he's
seeing that doesn't involve a tampered-with system?

--
Michael Fuhr