Linux – How to remove a file with no permissions

filesystemslinuxpermissions

A hacker has dropped a file in my tmp dir that is causing issues. Nothing malicious except creating GB's of error_log entries because their script is failing. However, the file they are using to execute has no permissions and even as ROOT I can't delete or rename this file.

----------  1 wwwusr wwwusr 1561 Jan 19 02:31 zzzzx.php

root@servername [/home/wwwusr/public_html/tmp]# rm zzzzx.php
rm: remove write-protected regular file './zzzzx.php'? y
rm: cannot remove './zzzzx.php': Operation not permitted

I have also tried removing by inode

root@servername [/home/wwwusr/public_html/tmp]# ls -il

...
1969900 ----------  1 wwwusr wwwusr 1561 Jan 19 02:31 zzzzx.php

root@servername [/home/wwwusr/public_html/tmp]# find . -inum 1969900 -exec rm -i {} \;

rm: remove write-protected regular file './zzzzx.php'? y
rm: cannot remove './zzzzx.php': Operation not permitted

How do I delete this file?

Best Answer

The file has probably been locked using file attributes.

As root, do

lsattr zzzzx.php

Attributes a (append mode) or i (immutable) present would prevent your rm. If they're there, then

chattr -ai zzzzx.php
rm zzzzx.php

should delete your file.

Related Question