sudo su error

Feek · 14 Aug 2021 at 23:21

Every time I sudo su on a CentOS7 system, I get this error.

Code:

bash: /root/.cache/abrt/lastnotification.Fl580G5f: cannot overwrite existing file
'abrt-cli status' timed out

The number after lastnotification is different every time.

There is a file in /root/.cache/abrt called lastnotification.

I've tried giving it +777 permissions, I get the same error.

I've even deleted it, it makes no difference. It comes back with these permissions.

Code:

-rw-------  1 root root 0 Aug 14 23:27 lastnotification

It's just a little frustrating, anyone know what I can do to fix this?

Thanks.

OldKitMan · 15 Aug 2021 at 01:15

anything else in .cache?

rm -rf /root/.cache and see if that fixes it.

Feek · 15 Aug 2021 at 01:53

OldKitMan said:
rm -rf /root/.cache and see if that fixes it.

Thanks.

Did that.

No different.

OldKitMan · 15 Aug 2021 at 09:10

As this is the 'automatic bug reporting tool' it may not be entirely necessary, as a nuclear option can you uninstall it?

maybe reinstall afterwards and see if it goes away, do you get the error if you 'sudo su -'?

Feek · 15 Aug 2021 at 10:47

Interesting, I disabled the abrt service and it didn't help but using sudo su - doesn't give me the error.

I can live with that, thanks.

leezer3 · 15 Aug 2021 at 15:16

I'd try clearing the cached bug reports, not the cache.

https://unix.stackexchange.com/questions/556307/what-is-the-right-approach-to-purge-var-spool-abrt

I'd guess one of these is corrupt. (Every time a new crash occurs, its checked against the existing ones to see if its a duplicate)

Fundamentally though, it looks like something is crashing. The tail of dmesg after trying to su may also have some details.

Feek · 15 Aug 2021 at 15:29

Good call but the cache is clear - There's nothing in /var/spool/abrt so there are no cached bug reports to clear

TangoEchoAlpha · 16 Aug 2021 at 22:26

If you know someone (or someone here?) has a Red Hat support subscription, maybe the solution for this will help (I can't see it as I don't have said subscription) - https://access.redhat.com/solutions/3077311

What happens if you do:

sudo touch /home/root/.hushlogin

and try again?

Feek · 16 Aug 2021 at 22:39

It's not just the
'abrt-cli status' timed out
message, it's the previous line that's bugging me as well.

Creating a .hushlogin in /root doesn't make any difference

TangoEchoAlpha said:
Red Hat support subscription, maybe the solution for this will help (I can't see it as I don't have said subscription) - https://access.redhat.com/solutions/3077311

Thanks, that would be really useful is someone is able to look at that for me.

TangoEchoAlpha · 16 Aug 2021 at 22:41

I am surprised, if you disable the last login notification then there should be no need for that file. Weird.

Feek · 16 Aug 2021 at 23:00

I've been able to find that info and basically it's saying to make sure the owner of /root/.cache/abrt/lastnotification is set to root.

Already checked that - It's set correctly.

Feek · 16 Aug 2021 at 23:12

There's something odd.

https://tuxrootsite.wordpress.com/2019/04/18/disable-last-login-message-centos-7/

When I run
>/var/log/lastlog

I get an error...

bash: /var/log/lastlog: cannot overwrite existing file

Which is strangely similar to the error I'm getting when sudo su

bash: /root/.cache/abrt/lastnotification.Fl580G5f: cannot overwrite existing file

I am root - I've logged in and done a sudo su so I should be able to overwrite these files.

VersionMonkey · 17 Aug 2021 at 11:42

Feek said:
There's something odd.

https://tuxrootsite.wordpress.com/2019/04/18/disable-last-login-message-centos-7/

When I run
>/var/log/lastlog

I get an error...

bash: /var/log/lastlog: cannot overwrite existing file

Which is strangely similar to the error I'm getting when sudo su

bash: /root/.cache/abrt/lastnotification.Fl580G5f: cannot overwrite existing file

I am root - I've logged in and done a sudo su so I should be able to overwrite these files.

The error from the redirection is possibly the bash noclobber setting. Try

set +o noclobber

and try again.

Feek · 17 Aug 2021 at 12:33

That allowed me to empty the lastlog file but didn't actually make any difference to the errors. I think I'm just going to have to live with it.

VersionMonkey · 17 Aug 2021 at 14:31

If the error on log in is also due to noclobber being on, then working out where it is being enabled would be key.

It's off on my Centos systems for both root and ordinary users. I don't know if that's a Centos default or not, but I don't recall doing anything to disable it.

Looking back over the thread, you get the error with "sudo su", but not with "sudo su -"? If so, it might be something to do with the environment of your normal user.

Does

Code:

set -o | grep noclobber

show it on or off in the normal user shell? If it is on, then try the "set +o noclobber" before issuing the sudo su.

Could also be something in your sudo config, I guess. For most maintenance, I would use "su -" anyway.

Feek · 17 Aug 2021 at 15:01

VersionMonkey said:
Looking back over the thread, you get the error with "sudo su", but not with "sudo su -"? If so, it might be something to do with the environment of your normal user.

It's really inconsistent.

Sometimes I get the single error, sometimes I get both errors, sometimes I get a 'last time I logged on' message, sometimes I don't.

No matter what I try, including the +noclobber from my own login, it literally is different each time I issue the same sudo su or sudo su - command.

However...

sudo -i

Just drops me to a # prompt. No last login message, no error.

VersionMonkey · 17 Aug 2021 at 16:51

I don't really have a good idea of where the problem is. But having had a poke around my Centos system both messages are probably coming from the script /etc/profile.d/abrt-console-notification.sh.

There's a bug already against abrt for the cannot overwrite error (https://github.com/abrt/abrt/issues/1371), which is fixed but may not have made it into Centos 7.

Other than the previously mentioned RedHat support article (which I can't read either - I also do not have a subscription), I can't see much about the timeout issue.

The script comes from the abrt-console-notification package which you could probably remove if you don't want to know about any detected problems when you log in.

I'd guess sudo -i doesn't run a login shell and therefore won't run the profile script.

Feek · 17 Aug 2021 at 21:55

VersionMonkey said:
I don't really have a good idea of where the problem is. But having had a poke around my Centos system both messages are probably coming from the script /etc/profile.d/abrt-console-notification.sh.

Quite possibly - I'm just going to live with it, thanks for trying to help though, it's most appreciated.

uvarvu · 17 Aug 2021 at 23:06

Feek said:
It's not just the 'abrt-cli status' timed out message, it's the previous line that's bugging me as well. Creating a .hushlogin in /root doesn't make any difference Thanks, that would be really useful is someone is able to look at that for me.

RHEL says to chown last notification to your user and then restart abrtd.

sithlord · 3 Sep 2021 at 12:01

I had a strange problem similar to this. I logged in as the actual root account from the login screen not "su".

It solved it for me... dunno why "su" is different.