File Copied to JFFS Partition Gets Deleted Automatically

[doug74]

I'm going absolutely bonkers with a problem on my current router, something that did not happen on my previous router

CURRENT ROUTER: RT-AX88U Pro, Merlin Firmware: 3004.388.7
PREVIOUS ROUTER: RT-AC86U, Merlin Firmware: 386.12.6

Here we go ...

I have a dnsmasq.conf.add file that's about 500K and my JFFS partition has roughly 43MB free.

If I copy the file to a temporary directory on my JFFS partion and the file contents uses UNIX linefeeds, the file gets saved but gets automatically deleted somehow within roughly 1-2 seconds.

Exact same file converted to DOS/Windows linefeeds and copied to my JFFS partition doesn't get automatically deleted, unless I run DOS2UNIX via SSH on it and then it gets automatically deleted again in the blink of the eye.

There are no user scripts running or cronjobs running, doesn't matter what the filename is either.

Any help would be greatly appreciated.

 

[ColinTaylor]

The Asus security demon will delete files (outside of the allowed directories) that contain content it thinks is malware or executable code.

Try splitting your file into smaller chunks and see if you can work out which lines it's objecting to.

 

[doug74]

Thanks for the reply, Colin!

It's not the file size or the directories, at least not for this one. It took me hours upon hours upon hours to figure it out, but I've now found the problem and it's pretty dumb.

If a file contains "wget" AND "worker" as substrings, anywhere in the file, and the file has UNIX linefeeds, the dang "security" daemon deletes the file. Both substrings must exist within the file. For instance, the "security" daemon autodeletes a simple text file containing domain names, such as:

Line100 contains: yadayadawgetyadayada.tld
[...]
Line5000 contains: blahblahworkerblahblah.tld

 

[Starlight8293]

Thanks for the reply, Colin!

It's not the file size or the directories, at least not for this one. It took me hours upon hours upon hours to figure it out, but I've now found the problem and it's pretty dumb.

If a file contains "wget" AND "worker" as substrings, anywhere in the file, and the file has UNIX linefeeds, the dang "security" daemon deletes the file. Both substrings must exist within the file. For instance, the "security" daemon autodeletes a simple text file containing domain names, such as:

Line100 contains: yadayadawgetyadayada.tld
[...]
Line5000 contains: blahblahworkerblahblah.tld

Hi, found this thread from google
I'm facing the same problem and may I know if you figured out any solution to this?

also as per colin mentioned, what are the so called allowed directories on asus router. I tried /jffs and /tmp but neither worked :/

 

[Crimliar]

I have my custom dynv6 inadyn.conf saved into /jffs/configs (currently none Merlin) so I can quickly copy it into /etc if needed. *I could just as easily have used the USB-SSD drive in this instance.

 

[doug74]

Hi, found this thread from google
I'm facing the same problem and may I know if you figured out any solution to this?

also as per colin mentioned, what are the so called allowed directories on asus router. I tried /jffs and /tmp but neither worked :/

No real "solution" to speak of. It was a plain text dnsmasq config file with domain blocks. Once I *finally* figured out the problem was having the substrings "wget" and "worker" in the same file, I just culled a few domain blocks that included "wget" because there were more with "worker" in the string.

Directory wise, it didn't matter. I was operating within subdirs of jffs and the daemon was killing the file.