为什么我不能创建一个以“ passwd”为前缀的文件。在“ / etc”中？

我有一台装有Ubuntu 16.04的PC。最近，我想安装一些软件包，但是在安装它们时遇到了麻烦。经过一番挖掘，我发现故障似乎与linux用户帐户系统有关。问题是passwd.无法在/etc路径中创建任何带有前缀前缀的文件。

# ls /etc/passwd.*
ls: cannot access '/etc/passwd.*': No such file or directory

# touch /etc/passwd.test-test-test
touch: cannot touch '/etc/passwd.test-test-test': Permission denied

# ls /etc/passwe.*
ls: cannot access '/etc/passwe.*': No such file or directory

# touch /etc/passwe.test-test-test
#

我可以在其他路径中创建该文件，例如/或/usr，但不能在/etc中创建，并且可以使用其他文件名将文件创建在中/etc，但不能将文件名以开头passwd.。我无法在其他PC上重现此问题。

我试过其他命令：

• nano /etc/shadow.xxx
• echo xxx > /etc/shadow.xxx
• touch /etc/test-temp-file && mv /etc/test-temp-file /etc/shadow.xxx
• systemctl stop apparmor
• 重新启动系统

没事。

是什么导致此问题？

这是一些调试命令输出：

# ls -ld /etc
drwxr-xr-x 136 root root 12288 Aug 12 10:07 /etc

# lsattr -d /etc
----------I--e-- /etc

# ls -dZ /etc
? /etc

# type -a touch
touch is /usr/bin/touch
touch is /bin/touch

# file "$(command -v touch)"
/usr/bin/touch: symbolic link to /bin/touch

这是strace输出：

# strace touch /etc/passwd.test-test-test
execve("/usr/bin/touch", ["touch", "/etc/passwd.test-test-test"], [/* 22 vars */]) = 0
brk(NULL)                               = 0x8da000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=80559, ...}) = 0
mmap(NULL, 80559, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f9bc360e000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\t\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1868984, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9bc360d000
mmap(NULL, 3971488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f9bc3033000
mprotect(0x7f9bc31f3000, 2097152, PROT_NONE) = 0
mmap(0x7f9bc33f3000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1c0000) = 0x7f9bc33f3000
mmap(0x7f9bc33f9000, 14752, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f9bc33f9000
close(3)                                = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9bc360c000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f9bc360b000
arch_prctl(ARCH_SET_FS, 0x7f9bc360c700) = 0
mprotect(0x7f9bc33f3000, 16384, PROT_READ) = 0
mprotect(0x60e000, 4096, PROT_READ)     = 0
mprotect(0x7f9bc3622000, 4096, PROT_READ) = 0
munmap(0x7f9bc360e000, 80559)           = 0
brk(NULL)                               = 0x8da000
brk(0x8fb000)                           = 0x8fb000
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=1668976, ...}) = 0
mmap(NULL, 1668976, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f9bc3473000
close(3)                                = 0
open("/etc/passwd.test-test-test", O_WRONLY|O_CREAT|O_NOCTTY|O_NONBLOCK, 0666) = -1 EACCES (Permission denied)
utimensat(AT_FDCWD, "/etc/passwd.test-test-test", NULL, 0) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=2995, ...}) = 0
read(3, "# Locale name alias data base.\n#"..., 4096) = 2995
read(3, "", 4096)                       = 0
close(3)                                = 0
open("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US.utf8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.UTF-8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.utf8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/en_US/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/en.utf8/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/en/LC_MESSAGES/coreutils.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
write(2, "touch: ", 7touch: )                  = 7
write(2, "cannot touch '/etc/passwd.test-t"..., 41cannot touch '/etc/passwd.test-test-test') = 41
open("/usr/share/locale/en_US.UTF-8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US.utf8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_US/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.UTF-8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.utf8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/en_US.UTF-8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/en_US.utf8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/en_US/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/en.UTF-8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/en.utf8/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale-langpack/en/LC_MESSAGES/libc.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
write(2, ": Permission denied", 19: Permission denied)     = 19
write(2, "\n", 1
)                       = 1
close(1)                                = 0
close(2)                                = 0
exit_group(1)                           = ?
+++ exited with 1 +++

我找出原因了。这是因为在我的PC上安装了ISecTP（Linux威胁防御的端点安全）。它包括“ 访问保护 ”，它使用fanotify内核接口或将自定义模块注入内核（可配置其中的哪个模块），从而导致对任意路径的访问被拒绝。我并不知道，因为我不是唯一使用PC的人。卸载后，现在一切正常。

谢谢你们每一个人的帮助！