<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.3020" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007>Whoa! You have a bigger problem than you think --
your ls output shows that /dev/null has been replaced by a normal file.
The null device is supposed to be a character special device file that discards
anything written to it.</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007>The exact major and minor number (and potentially the
requirements to create it) are specific to your platform (Linux, Solaris, HPUX)
and possibly your kernel version. If you're using Linux, you probably have
a manual page for "null", so see "man null".</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007>On my Redhat Enterprise systems, /dev/null is always
like so:</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007># ls -l /dev/null<BR>crw-rw-rw- 1
root root
1, 3 Jun 24 2004 /dev/null<BR></SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007>Notice the 'c' in the first column -- that means it's a
character special file.</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007>Notice the "1, 3" after the group ownership -- those
are the major and minor numbers.</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007>If you're running a linux system, you probably need to
do the following:</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007>rm -f /dev/null</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007>mknod -m 666 /dev/null c 1 3</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007>chown root:root /dev/null</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007>Lots of things write to /dev/null. Having that be
a special file WILL break things and will probably cause the / filesystem to
fill eventually. Once /dev/null becomes completely unwriteable (as would
happen if the filesystem fills), the machine will probably not boot up
cleanly.</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007>Back to WHY this occurred, I would not for something
that *changes* /dev/null, but rather for something that *removes* /dev/null by
mistake. Once it's been removed, whatever attempts to write to that file
next will create a file and the ownership will be set depending on the writing
process' uid/gid/umask.</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007>This is actually a common thing. I used an ftp
library once that asked for a log file, and at some point I decided to discard
the logs by setting the log file to "/dev/null". Unfortunately for me, the
library actually unlinked the log file (/dev/null) instead of just opening it
and seeking to the beginning of the file. A few weeks after I made the
change, / was filled and lots of things started to fail.</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007>Hope that helps,</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007>Trever</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=994092519-17012007> </DIV></SPAN></FONT><BR>
<BLOCKQUOTE
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B>
mailscanner-bounces@lists.mailscanner.info
[mailto:mailscanner-bounces@lists.mailscanner.info] <B>On Behalf Of </B>den
gon<BR><B>Sent:</B> Monday, January 15, 2007 9:45 PM<BR><B>To:</B>
mailscanner@lists.mailscanner.info<BR><B>Subject:</B> Modified /dev/null by
MailScanner?<BR></FONT><BR></DIV>
<DIV></DIV>Hi again to all,<BR><BR>I noticed that when I login on my system
using non-root account, its says<BR>"-bash: /dev/null: Permission denied". I
checked it permission and it owned by <BR>root and smmsp. Is it the
MailScanner/sendmail process changed it? <BR><BR>"-rw-------
1 root smmsp 23448
Jan 16 10:35 /dev/null"<BR><BR>admin@server's password:<BR>Last login: Tue Jan
16 10:10:38 2007 from x.x.x.x<BR>-bash: /dev/null: Permission denied<BR>-bash:
/dev/null: Permission denied <BR>-bash: /dev/null: Permission denied<BR>-bash:
/dev/null: Permission denied<BR>-bash: /dev/null: Permission denied<BR>-bash:
/dev/null: Permission denied<BR>[admin@server admin]$ su
-<BR>Password:<BR>[root@server
root]#
<BR><BR>Regards,<BR><BR>ned<BR></BLOCKQUOTE></BODY></HTML>