Encontrou uma resposta - é um bug do kernel anterior a 3.18 O comportamento é causado por firejail: link
Não consigo remover /etc/group- - por que não?
root@dom:/etc# whoami
root
root@dom:/etc# pwd
/etc
root@dom:/etc# rm -f /etc/group-
rm: cannot remove ‘/etc/group-’: Device or resource busy
root@dom:/etc# fuser -v /etc/group-
root@dom:/etc# mount
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
udev on /dev type devtmpfs (rw,relatime,size=10240k,nr_inodes=2040032,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,relatime,size=3280816k,mode=755)
/dev/sde1 on / type ext4 (rw,relatime,errors=remount-ro,data=ordered)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k)
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/lib/systemd/systemd-cgroups-agent,name=systemd)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpu,cpuacct)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup (rw,nosuid,nodev,noexec,relatime,net_cls,net_prio)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,nosuid,nodev,noexec,relatime,perf_event)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=22,pgrp=1,timeout=300,minproto=5,maxproto=5,direct)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
mqueue on /dev/mqueue type mqueue (rw,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime)
/dev/sda1 on /var type ext4 (rw,relatime,errors=remount-ro,data=ordered)
/dev/sdd1 on /opt type ext4 (rw,relatime,errors=remount-ro,data=ordered)
/dev/sdc1 on /mediafiles type ext4 (rw,relatime,errors=remount-ro,data=ordered)
/dev/sdb1 on /mediafiles/blurays type ext4 (rw,relatime,errors=remount-ro,data=ordered)
rpc_pipefs on /run/rpc_pipefs type rpc_pipefs (rw,relatime)
tmpfs on /run/user/0 type tmpfs (rw,nosuid,nodev,relatime,size=1640408k,mode=700)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=1640408k,mode=700,uid=1000,gid=1000)
root@dom:/etc# uname -a
Linux dom 3.16.0-4-amd64 #1 SMP Debian 3.16.43-2+deb8u2 (2017-06-26) x86_64
GNU/Linux
root@dom:/etc# lsof +D /etc
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
openvpn 1855 nobody cwd DIR 8,65 4096 13634055 /etc/openvpn
jsvc 2070 root 3r REG 8,65 1649 13634356 /etc/java-8-openjdk/jvm-amd64.cfg
jsvc 2070 root 4r REG 8,65 1649 13634356 /etc/java-8-openjdk/jvm-amd64.cfg
jsvc 2078 root 3r REG 8,65 1649 13634356 /etc/java-8-openjdk/jvm-amd64.cfg
jsvc 2078 root 4r REG 8,65 1649 13634356 /etc/java-8-openjdk/jvm-amd64.cfg
jsvc 2079 root 3r REG 8,65 1649 13634356 /etc/java-8-openjdk/jvm-amd64.cfg
jsvc 2079 root 4r REG 8,65 1649 13634356 /etc/java-8-openjdk/jvm-amd64.cfg
mc 3538 root cwd DIR 8,65 12288 13631489 /etc
bash 3547 root cwd DIR 8,65 12288 13631489 /etc
mc 5549 root cwd DIR 8,65 12288 13631489 /etc
bash 5551 root cwd DIR 8,65 12288 13631489 /etc
lsof 5928 root cwd DIR 8,65 12288 13631489 /etc
lsof 5929 root cwd DIR 8,65 12288 13631489 /etc
root@dom:/etc# ls -l /etc/group-
-rw------- 1 root root 1168 Jul 17 21:53 /etc/group-
root@dom:/etc# ls -l /|grep etc
drwxr-xr-x 153 root root 12288 Jul 17 21:57 etc
root@dom:/etc#
Encontrou uma resposta - é um bug do kernel anterior a 3.18 O comportamento é causado por firejail: link