Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1047068 - Directory /dev/dev gets created with an invalid soft link in it
Summary: Directory /dev/dev gets created with an invalid soft link in it
Keywords:
Status: CLOSED DUPLICATE of bug 1045116
Alias: None
Product: Fedora
Classification: Fedora
Component: dracut
Version: 20
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: dracut-maint-list
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-12-28 19:49 UTC by John Horne
Modified: 2014-01-09 08:59 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-01-09 08:59:37 UTC
Type: Bug


Attachments (Terms of Use)

Description John Horne 2013-12-28 19:49:51 UTC
Description of problem:
Something creates the directory '/dev/dev'. Inside it is a symbolic link to the disk device 'sda2' - a swap partition.
The link is called 'resume' but points to '../../sda2'.
Obviously '../..' takes us to the root partition, where 'sda2' does not exist.
I suspect it should point to '../sda2', which does exist.


Version-Release number of selected component (if applicable):
util-linux-2.24-2.fc20.x86_64
filesystem-3.2-19.fc20.x86_64

How reproducible:
Not sure! I cannot see what is creating '/dev/dev'.

Steps to Reproduce:
1.Install F20
2.
3.

Actual results:
As above in description - '/dev/dev' is created, but contains an invalid link.
Some info:
# ls -ldZ /dev/dev
drwxr-xr-x. root root system_u:object_r:device_t:s0    /dev/dev

# rpm -qf /dev/dev
file /dev/dev is not owned by any package

cd /dev/dev
# ls -lZ
lrwxrwxrwx. root root system_u:object_r:device_t:s0    resume -> ../../sda2

# ls -l ../../sda2
ls: cannot access ../../sda2: No such file or directory

# ls -l ../sda2
brw-rw----. 1 root disk 8, 2 Dec 28 18:44 ../sda2

# swapon -s
Filename                                Type            Size    Used    Priority
/dev/sda2                               partition       8388604 0       0
/dev/sdc2                               partition       8388604 0       0


Expected results:
I suspect '/dev/dev' should not exist?


Additional info:
I have only just installed F20, but 'rkhunter' detects '/dev/dev' as part of a rootkit. This is how I noticed the problem.
Using 'swapon -s' shows both my swap partitions (sda2 and sdc2) as being available.
Commenting out the 'sda2' entry from '/etc/fstab', then rebooting, makes no difference. The '/dev/dev' directory and invalid link are still created.
Booting to single user mode also made no difference - directory and link were still there.

Comment 1 g. artim 2014-01-08 17:03:28 UTC
same issue, shows up in rkhunter as GasKit Rootkit /dev/dev/ exists.

Comment 2 Harald Hoyer 2014-01-09 08:59:37 UTC

*** This bug has been marked as a duplicate of bug 1045116 ***


Note You need to log in before you can comment on or make changes to this bug.