Ubuntu
util-linux package

invalid UID and GID and huge size files

Asked by James Grover

Apparently my hard drive took a hit, and I have a couple of files that have out of range UID and GID, and are multi-gigabytes in size. I can't do anything to these files (delete, zero, change mode, etc.). In my previous life as a Unix administrator, we used to zero the INODE and run fsck. But I've been away long enough to no longer remember how to do that! I was able to move the directory for one of the files to /tmp, but the other file is in a directory with too many other files, sooo HELP PLEASE!!
Here's the file information:

/tmp/BAD/changelog.gz
---x--xr-x 1 1464762445 1464781532 4273602233 2023-10-01 08:24 changelog.gz

/home/jim/.evolution/mail/views/custom_view-mbox:_home_jim_.evolution_mail_local_USGA.xml
--w----rwx 1 2512683143 2512688668 2929766048 2010-12-28 01:56 custom_view-mbox:_home_jim_.evolution_mail_local_USGA.xml

Thanks,
JG

Question information

Language:
English Edit question
Status:
Solved
For:
Ubuntu util-linux Edit question
Assignee:
No assignee Edit question
Solved by:
James Grover
Solved:
Last query:
Last reply:
Revision history for this message
James Grover (jfgrover47) said : 		#1

BTW, I did boot up on the stand-alone CD, but it wouldn't let me modify the files either.

Revision history for this message
mycae (mycae) said : 		#2

Root should be able to delete those files, regardless of the UID/GID

sudo rm -f NAME_OF_FILE

Revision history for this message
James Grover (jfgrover47) said : 		#3

Root does not have permission - either running normally or from the CD (Live).
Error message is "rm: cannot remove `changelog.gz': Operation not permitted"

Sorry,
JG

Revision history for this message
James Grover (jfgrover47) said : 		#4

I have also run "e2fsck -f" on the partition (from the Live CD) and it found no problems.
Sorry, I should have included that in the original post.

JG

Revision history for this message
mycae (mycae) said : 		#5

Your filesystem may be damaged, and the kernel may be detecting this and setting the device to read-only.

Have you fsck -ed the drive?

Can you provide the output of :

mount

?

Revision history for this message
James Grover (jfgrover47) said : 		#6

Here's my "mount" results:

jim@i7:~$ mount
/dev/sda2 on / type ext4 (rw,relatime,errors=remount-ro,commit=0)
proc on /proc type proc (rw)
none on /sys type sysfs (rw,noexec,nosuid,nodev)
fusectl on /sys/fs/fuse/connections type fusectl (rw)
none on /sys/kernel/debug type debugfs (rw)
none on /sys/kernel/security type securityfs (rw)
none on /dev type devtmpfs (rw,mode=0755)
none on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)
none on /dev/shm type tmpfs (rw,nosuid,nodev)
none on /var/run type tmpfs (rw,nosuid,mode=0755)
none on /var/lock type tmpfs (rw,noexec,nosuid,nodev)
/dev/sdb1 on /backup type ext4 (rw,relatime,commit=0)
/dev/sda3 on /home type ext4 (rw,relatime,commit=0)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev)
gvfs-fuse-daemon on /home/jim/.gvfs type fuse.gvfs-fuse-daemon (rw,nosuid,nodev,user=jim)

FYI,
JG

Revision history for this message
James Grover (jfgrover47) said : 		#7

Sorry, a mind is a terrible thing to waste. I finally remembered how to fix the problem.
Here's the fix:
The program to use is "debugfs" and the command is "clri" not "cleari".
In fact, while using debugfs, I was able to remove the file using the "rm" command.
All this was done while running on the "Live" CD (Ubuntu Desktop 10-10 64-bit).
Thanks to mycae for the help.
However, the problem is still real - whatever caused the files to have invalid UID, GID, and huge sizes
keeps even root from modifying those files.
Thanks again,
JG