Security Incidents mailing list archives

.rpc_door, what is that?


From: James Kelty <james () TUNA ORG>
Date: Thu, 21 Dec 2000 10:41:03 -0800

Hello,

Yesterday I was wondering around on one of my systems when I noticed
something I hadn't seen in the /tmp filesystem before.
Does anyone know what a directory called .rpc_door would be doing in the
/tmp filesystem?  There are also three subdirectories with a capitol
"D" for file type. What is the capitol "D" for?

I am including a typescript file from the system.

Last login: Wed Dec 20 15:23:34 2000 from 172.25.10.54
Sun Microsystems Inc.   SunOS 5.7       Generic October 1998
No mail.
Sun Microsystems Inc.   SunOS 5.7       Generic October 1998
root@host # cd /tmp
root@host # ls-a
ls-a: not found
root@host # ls -a
.          ..         .pcmcia    .rpc_door  ps_data
root@hist # script
Script started, file is typescript
root@host # ls -a
.           ..          .pcmcia     .rpc_door   ps_data     typescript
root@host #
root@host # cd rpc_door
rpc_door: does not exist
root@host # cd .rpc_door
root@host # ls -a
.              ..             .rpc_100029.1  .rpc_100029.2
.rpc_100029.3
root@host # ls -al
total 16
drwxrwxrwt   2 root     root         207 Dec 14 18:50 .
drwxrwxrwt   4 sys      sys          234 Dec 21 10:22 ..
Drw-r--r--   1 root     root           0 Dec 14 18:50 .rpc_100029.1
Drw-r--r--   1 root     root           0 Dec 14 18:50 .rpc_100029.2
Drw-r--r--   1 root     root           0 Dec 14 18:50 .rpc_100029.3
root@host # cd ../
root@host # ls -al
total 42
drwxrwxrwt   4 sys      sys          234 Dec 21 10:22 .
drwxr-xr-x  26 root     root        1024 Dec 21 08:10 ..
drwxrwxrwx   2 root     root         107 Dec 14 18:51 .pcmcia
drwxrwxrwt   2 root     root         207 Dec 14 18:50 .rpc_door
-rw-rw-r--   1 root     sys         5920 Dec 14 18:50 ps_data
-rw-r--r--   1 root     other          0 Dec 21 10:22 typescript
root@host # exit

Just incase you wanted to know, this system is Solaris 7 running on x86.

Thanks!

-James


Current thread: