Operation not permitted error

[Peter Skensved <peter owl phy queensu ca>]

	A few weeks ago one of our computers running RHL 5.1 was hacked and
a number of bogus binaries were installed. I decided that the easiest way to 
recover was to upgrade to 5.2 and then recheck everything with rpm -Vp .
The upgrade went fine except when it came time to replace the bogus /bin/login
where rpm came up with  an `Operation not permitted' error. Running
rpm --force -Uv on the util-linux package under single user gave me the same
error so I booted from a set of ancient ( good ) rescue floppies. Same error !
  In fact, any time I tried modifying or doing something to the bogus
/bin/login ( like rm, mv, chmod, chown, dd of=/bin/login  ... ) I got the same
`Operation not permitted error. ls and file ( run off the floppies ) told me
the file was an ELF executable with a link count of one and no hidden
characters in the name. The bogus /bin/login could be copied and the copy 
was removable. Does anybody know what has happened to the filesystem ?
fsck and badblocks didn't report any problems with the partition.
Only mkfs seemed to fix the problem ...


																															peter

----

Peter Skensved                          Email : peter SNO Phy QueensU CA nospam
Dept. of Physics,                       Phone:  (613) 545-2676
Queen's University,                     Fax:    (613) 545-6813
Kingston, Ontario,
Canada