#1142702 lsof: WARNING: can't stat()

Package:
tiger
Source:
tiger
Description:
security auditing and intrusion detection tools for Linux
Submitter:
Stefano Callegari
Date:
2026-07-24 10:29:02 UTC
Severity:
normal
#1142702#5
Date:
2026-07-24 10:20:55 UTC
From:
To:
Dear Maintainer,

after the cron command run by root

test -x /usr/sbin/tigercron && { [ -r "$DEFAULT" ] && . "$DEFAULT" ; nice -n$NICETIGER /usr/sbin/tigercron -q ; }

the email body is

[...]
lsof: WARNING: can't stat() fuse.portal file system /run/user/1000/doc
      Output information may be incomplete.
lsof: WARNING: can't stat() fuse.kio-fuse file system /run/user/1000/kio-fuse-zbmsAg
      Output information may be incomplete.
[...]

nothing else.

Searching on google I found this https://www.openwall.com/lists/oss-security/2024/05/11/3

[...]
These are FUSE filesystems running as uid 1000, which by default are
not accessible *by root* - which might seem strange at first glance,
but is an intentional security mechanism to protect root from being
attacked by uid 1000 (see mount.fuse3(8) for details).
[...]

so

[...]
ven lug 24 10:58:00 stefano@G5045
~ <bash> $ lsof /run/user/1000/doc

ven lug 24 10:58:07 stefano@G5045
~ <bash> $ lsof /run/user/1000/kio-fuse-zbmsAg

ven lug 24 10:58:27 stefano@G5045
~ <bash> $ su -
Password:

ven lug 24 10:58:37 @G5045:
~ <-bash> # lsof /run/user/1000/doc
lsof: WARNING: can't stat() fuse.portal file system /run/user/1000/doc
      Output information may be incomplete.
lsof: WARNING: can't stat() fuse.kio-fuse file system /run/user/1000/kio-fuse-zbmsAg
      Output information may be incomplete.
lsof: status error on /run/user/1000/doc: Permission denied

ven lug 24 10:58:44 @G5045:
[...]


Thanks

Stefano