Mysterious File

[Trevor]

Is it possible for a file, with the following characteristics  amd behavior
to exist on a Linux system:
- cannot be permantently deleted by root (i.e. goes away, but then returns)
- remains even after the system is rebooted
- ignores chmod 
- ignores chown

Note:
- The file is NOT immutable.  
- The file is not a symlink
- The file is not on a read-only mounted file system

[Chetan_Tiwary_]

@Trevor yup, /etc/mtab file does resurrect after reboot, and then you have /proc and        /sys files which are virtual and created by kernel on demand and do not exist on disk. 

NOTE: mtab also is a symlink to /proc/mounts fs. 

[Chetan_Tiwary_]

and also the root_squash thing in a NFS mount !!

[Trevor]

Chetan,

Starting with /etc/mtab filename (symlink) does resurrect after
reboot.  However, based on the specification that I gave for the
characteristics of the file - it is not a symlink - the /etc/mtab
violates that spec.  Yes, I can delete the /etc/mtab name, and
rebooting the system re-establishes it.  Yes, /etc/mtab does
ignore both the chmod and chown commands. But that one
thing - it's a symlink - is causing me to disqualify it.

Regardintg the /proc filesystem, files that reside there do NOT
ignore chmod or chown.  I was able to change the permissions
on a file there, as well as change the owner of a file there.  Those
changes remained after a reboot of the system.  I'm not able
to delete files, or add files to the /proc filesystem, but that wasn't
part of my criteria.

Finally, regarding the /sys filesystem, the directories in there are
NOT ignoriing chown or chmod.  However, I'm not able to delete
an existing directory, or add one - even though I'm able to set 
the 'w' permission across the board (ugo).  I have to disqualify
the /sys filesytem and it's content because I'm not able to delete
anything in the filesystem, to see that it does resurrect after reboot.

Overall, I did see somethings that I didn't expect to see.  However,
neither the /etc/mtab symlink, /proc filesystem, or /sys filesystem,
met all of the criteria that I specified.  

An additional something that I got from your response, which I 
wasn't seeking, and may not have been intended on your part,
was that I could do a better job in fine tuning my question - better
explicit wording.

Thanks for another lesson!!!

[smudgy]

cannot be permantently deleted by root (i.e. goes away, but then returns) - This sounds like some systemd managed files.  Any file on a linux file system can be deleted by root, as far as I know.  You could try attributes or ACL's to protect a file, but it can all be undo by root.  

remains even after the system is rebooted - This isn't magic as ever file can do this, though maybe /tmp contents get wiped out during the boot up process.

- ignores chmod 
- ignores chown
An overlay file system like unionfs?

So something that can do all of this?  Maybe SELinux (beyond just labels) can limit the power of root or modifications in visudo?

[Trevor]

Thanks for your response smudgy.

[Travis]

@Trevor -

So very weird question and interesting at the same time. There aren't a whole lot of things that fall into your scenario, but the FUSE and Overlay filesystems would be among these. Think of a container, it lays down temporary filesystem and the files technically exist on your system (they aren't symlinks and they aren't read only - they are part of the overlayfs). You can delete the files and they are removed from the overlayfs, however, when the container gets deleted and recreated, the files "return" as if by magic.

Other instances would be SELinux policies which could prevent true deletions or override what root could do.

Finally, special kernel modules could grab the system calls and intercept what is going on and basically lie and say the file is deleted, but it actually isn't.

To me though, based on all your other questions, you are asking this for a reason ... if that is the case and you see a mysterious file like this another possibility is a Rootkit.

[Chetan_Tiwary_]

Rootkit as in the malware ? https://www.crowdstrike.com/en-us/cybersecurity-101/malware/rootkits/