Re: [PLUG] what could be broken?

["eric@lucii.org" <eric@lucii.org>]

On Wed, Dec 08, 2004 at 08:54:18PM -0500, Kevin Brosius wrote:
> > > Is there a reason you aren't using the SuSE supplied rpm's for less or
> > > some other system libraries? Did you check in yast to see if something
> > > was missing? It's good that you got it working... but I'd caution
> > > against using rpmfind.net in general, unless it finds you SUSE 9.1
> > > RPMs. When I search it for libmagic, I see:
> > >
> > > libmagic-4.07-1.i686.html libmagic library PLD Linux Distribution
> > > libmagic-4.07-1.i686.rpm
> > 
> > I checked the SuSE 9.1 DVD and there was no libmagic listed anywere in there.
> > Perhaps it was part of another rpm but rpm shows me zero information regarding
> > libmagic.so before I installed it myself.
> > 
> 
> No... What I was trying to hint at is that the problem lies somewhere
> else.  SUSE does not have a libmagic.so by default.  And less does not
> use it.  I don't have SUSE 9.1 here, but SUSE 9.0 and 9.2 both look the
> same as what you've already said, no shared library, but they do have
> the libmagic.a and .la.  Just for information purposes:
> 
> ~> rpm -q -f /usr/lib/libmagic.a
> file-4.03-40
> 
> So, libmagic development files are supplied by the file package.  But
> more importantly,
> 
> ~> ldd `which less`
>                 libncurses.so.5 => /lib/libncurses.so.5 (0x4002e000)
>         libc.so.6 => /lib/libc.so.6 (0x40074000)
>         /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
> 
> (on SUSE 9.0.  9.2 also uses something called linux-gate.so.1).
> 
> So, less does not need libmagic.so.  The question you need to ask is...
> what does?  Is something else running when you run less?  I'm not sure
> how less handles compressed filetypes.  Did you see the same problem on
> plain text files?  It may use helpers for decompression, and one of
> those is giving you the error.
> 
> -- 
> Kevin

Thanks.  I found the problem.

I installed sleuthkit and autopsy on this workstation to learn how to 
use them.  After a recent reboot I got _this_ message when I ran less:

[eric]$ less .bashrc
file: cannot read magic file
`/root/updates/sleuthkit/sleuthkit-1.73/share/file/magic' (Permission denied)

I moved all the sleuthkit/autopsy executable files in /usr/local/bin to
/usr/local/bin/sleuthkit  and the problem vanished.

I'm not sure *why* this happened.

Here are the sleuthkit executables...
   dcalc
   dcat
   diskstat
   dls
   dstat
   ffind
   file
   fls
   fsstat
   hfind
   icat
   ifind
   ils
   istat
   jcat
   jls
   mactime
   md5
   mmls
   sha1
   sigfind
   sorter
   sstrings

Now I see that less must rely on "file" (as in /usr/bin/file) but it was
finding /usr/local/bin/file first :-P

I did learn a few things about the problem...

  1. I relied on 'locate' to try to find the libmagic.so.1 file.  
     'updatedb' does not look in the /root directory where those files 
     reside.

  2. I did not keep a log of the files/software I installed so that I
     could relate the problem to something that I did rather than something
     SuSE did.

Thanks to everyone who replied!


Eric
-- 
------------------------------------------------------------------------
#   Eric Lucas 
========================================================================
The aim of public education is not to spread enlightenment at all; it is
simply to reduce as many individuals as possible to the same safe level,
to breed a standard citizenry, to put down dissent and originality. 
  -- H.L. Mencken
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug