by Juno Sprite.
$ cd /companydata
$ ls -l /companydata
total 64
drwxrwxrwx 2 www-data www-data 4096 Aug 7 2021 antivirus_quarantine
drwxrwxrwx 5 root root 4096 Feb 14 16:00 cache
drwxr-xr-x 3 root root 4096 Nov 30 2021 dkim
drwxrwxrwx 2 root root 4096 Aug 10 2020 environment
drwxrwxrwx 258 root root 4096 Aug 10 2020 filedir
drwxrwxrwx 4 root root 4096 Dec 21 09:37 lang
drwxrwxrwx 8 root root 4096 Feb 9 23:53 localcache
drwxrwxrwx 115 root root 4096 Aug 10 2020 lock
drwxrwxrwx 5 root root 4096 Aug 10 2020 models
drwxrwxrwx 2 root root 4096 Dec 9 05:17 muc
drwxrwxrwx 3 www-data www-data 12288 Feb 14 20:26 sessions
drwxrwxrwx 2 www-data www-data 4096 Jan 24 2022 sessions.old
drwxrwxrwx 9 root root 4096 Feb 14 16:08 temp
drwxrwxrwx 2 www-data www-data 4096 Feb 14 17:59 trashdir
$ ls -l ./temp/backup/
total 4
[...more log files...]
-rw-rw-rw- 1 www-data www-data 0 Feb 8 20:30 6890074cf6183e0299edf30bd204048e.log
-rw-rw-rw- 1 www-data www-data 0 Feb 8 20:30 6a77d7d9ad19bfd1bd9043d4b6e2c395.log
drwxrwsrwx 5 www-data www-data 4096 Feb 14 05:52 6fe30bd47a3ab6ade18ff6f57bcc098e
-rw-rw-rw- 1 www-data www-data 0 Feb 14 05:50 6fe30bd47a3ab6ade18ff6f57bcc098e.log
-rw-rw-rw- 1 www-data www-data 0 Feb 14 05:47 711beea9acea2bb14184677cf5e6e3b9.log
[...more log files...]
There are a bunch of .log files there, which all have the same permissions and everything, but there is that one directory in the middle there, so...
$ ls -l ./temp/backup/6fe30bd47a3ab6ade18ff6f57bcc098e
total 451976
drwxrwsrwx 7 www-data www-data 4096 Feb 14 05:52 activities
drwxrwsrwx 3 www-data www-data 4096 Feb 14 05:52 course
-rw-rw-rw- 1 www-data www-data 3103 Feb 14 05:52 groups.xml
-rw-rw-rw- 1 www-data www-data 462802906 Feb 14 06:13 questions.xml
drwxrwsrwx 3 www-data www-data 4096 Feb 14 05:52 sections
Does this help at all? The permissions on companydata directory and subdirectorys definitely seem curious....
$ ls -l /companydata
total 64
drwxrwxrwx 2 www-data www-data 4096 Aug 7 2021 antivirus_quarantine
drwxrwxrwx 5 root root 4096 Feb 14 16:00 cache
drwxr-xr-x 3 root root 4096 Nov 30 2021 dkim
drwxrwxrwx 2 root root 4096 Aug 10 2020 environment
drwxrwxrwx 258 root root 4096 Aug 10 2020 filedir
drwxrwxrwx 4 root root 4096 Dec 21 09:37 lang
drwxrwxrwx 8 root root 4096 Feb 9 23:53 localcache
drwxrwxrwx 115 root root 4096 Aug 10 2020 lock
drwxrwxrwx 5 root root 4096 Aug 10 2020 models
drwxrwxrwx 2 root root 4096 Dec 9 05:17 muc
drwxrwxrwx 3 www-data www-data 12288 Feb 14 20:26 sessions
drwxrwxrwx 2 www-data www-data 4096 Jan 24 2022 sessions.old
drwxrwxrwx 9 root root 4096 Feb 14 16:08 temp
drwxrwxrwx 2 www-data www-data 4096 Feb 14 17:59 trashdir
$ ls -l ./temp/backup/
total 4
[...more log files...]
-rw-rw-rw- 1 www-data www-data 0 Feb 8 20:30 6890074cf6183e0299edf30bd204048e.log
-rw-rw-rw- 1 www-data www-data 0 Feb 8 20:30 6a77d7d9ad19bfd1bd9043d4b6e2c395.log
drwxrwsrwx 5 www-data www-data 4096 Feb 14 05:52 6fe30bd47a3ab6ade18ff6f57bcc098e
-rw-rw-rw- 1 www-data www-data 0 Feb 14 05:50 6fe30bd47a3ab6ade18ff6f57bcc098e.log
-rw-rw-rw- 1 www-data www-data 0 Feb 14 05:47 711beea9acea2bb14184677cf5e6e3b9.log
[...more log files...]
There are a bunch of .log files there, which all have the same permissions and everything, but there is that one directory in the middle there, so...
$ ls -l ./temp/backup/6fe30bd47a3ab6ade18ff6f57bcc098e
total 451976
drwxrwsrwx 7 www-data www-data 4096 Feb 14 05:52 activities
drwxrwsrwx 3 www-data www-data 4096 Feb 14 05:52 course
-rw-rw-rw- 1 www-data www-data 3103 Feb 14 05:52 groups.xml
-rw-rw-rw- 1 www-data www-data 462802906 Feb 14 06:13 questions.xml
drwxrwsrwx 3 www-data www-data 4096 Feb 14 05:52 sections
Does this help at all? The permissions on companydata directory and subdirectorys definitely seem curious....