# Blocked (home) directory access

## acarstoiu

Apparently out of the blue, I started to get locked out of my home directory. The last changes to my system were made last weekend when I updated KDE to 4.6.2. No kernel (2.6.38-gentoo-r1) or other sensitive packages upgrades. Before that I had performed a 

```
emerge -e world
```

It happens randomly and I have no idea of what might cause it, after eliminating some suspects (I went as far as changing the default I/O scheduler from cfq to deadline). Apparently for no reason X (or KDE) freezes suddently, except for the mouse pointer which moves but other than that is useless. All the running system services are fine (ssh, samba, dns, mail, you name it). While /home is the mountpoint of a hard disk partition, I can list it, but 

```
ls /home/<myuser>
```

 just hangs. So does 

```
strace sync
```

 with a final line reading "sync(" - yes, call parameters don't make it to the console.

top doesn't show any notable thing and logs in /var/log/ don't show anything wrong either. Obviously, I can't access my .xsession-errors because my home directory is blocked. Naturally, since sync is not working, the computer won't even reboot gracefully. All these actions are, of course, tried out as root.

After using the hard reset button, tons of file transactions are replayed and everything goes fine until a some hours or a day later.

Does anyone know what on earth can make the kernel block any possible access to a directory (which isn't even a mount point)?   :Shocked: 

----------

## nick_already_taken

Why filesystem do you use? Have you tried running e2fsck or reiserfsck on the partition?

----------

## acarstoiu

ReiserFS, and the check is automatically performed after each crash recover (hard reboot). All pending transactions are replayed, or so it says...

----------

## acarstoiu

This happened again, but my home directory was still accessible; on the contrary, 

```
less ~/.xsession-errors
```

 blocked. 

```
strace sync
```

 blocked the console as well.

Please help me    :Confused:  I need possible causes... I'm starting to consider the possibility to have been hacked.

----------

## Aquous

Try a manual fsck. (touch /forcefsck && reboot)

Also trigger the problem (e.g. find ~/) and then post dmesg.

----------

## nick_already_taken

 *acarstoiu wrote:*   

> This happened again, but my home directory was still accessible; on the contrary, 
> 
> ```
> less ~/.xsession-errors
> ```
> ...

 

It is difficult for me to help.

I would try also to find the cause of this with the help of "lsof". If you think you have been hacked you could also

try these tools:

http://znurt.org/app-forensics/chkrootkit

http://znurt.org/app-forensics/rkhunter

How about booting your system from a live distribution like http://www.sysresccd.org ?

----------

## Raptor85

I assume it's  a separate drive?  I would try unmounting it while it's still working and running a check on it (no real need to reboot to check /home)  Could be the onset of drive failure, or perhaps a bad cable/insufficient power supply.  maybe run dmesg in a console and watch it for when the freeze occurs, see if there's any messages.

----------

## acarstoiu

Thank you all. I haven't replied right away since my dmesg log has always looked clean (even when sync blocked) and I also did force partition check upon reboot once or twice.

The hard-disk we're talking about was recently replaced by a new one, because SMART detected some errors on it (but the OS never complained about anything) and I wanted to be on the safe side. Never had any problems with the previous hard-disk.

chkrootkit yielded nothing, as well.

I tend to blame KDE for this situation since the server has been running for 5 days now without any sign of misbehaviour, without the KDE session being started.

Thanks again!

----------

## acarstoiu

In case anyone cares, here's the actual culprit:

```
  PID USER            STAT WCHAN                           PPID S TTY          TIME COMMAND

  179 root            D    queue_log_writer                   2 D ?        00:00:12 [sync_supers]
```

It blocks both mail and KDE services, resulting in the situation explained above.

I've recompiled the kernel with relevant debugging support and will wait for the next lock up so as to post a bug report   :Confused: 

----------

