On 07/18/2015 07:10 PM, Ed Greshko wrote:
sudo debugfs -R 'ncheck 47972353' /dev/sda3 2>/dev/null
debugfs -R 'ncheck 47972353' /dev/sda3 2>/dev/null
Inode Pathname
47972353 //root
So, why is it trying to do that?
I am not logged in as root.
How can I find out the process(es) that spawned sh
to access /root?