[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: ext3 hacked filesystem (by debian exim4 exploit) available for analy
Re: ext3 hacked filesystem (by debian exim4 exploit) available for analysis and bugreporting
Fri, 29 Jul 2011 22:47:14 -0400
2011/7/29 Pádraig Brady <address@hidden>:
>>> Should ls -l be moddified to show something when file has immutable
>>> (and friends) set?
>> AFAICT lsattr, in e2fsprogs, only does a 'stat'(lib/e2p/fgetflags.c) and
>> checks st_flags, which i can't see in the "man 2 stat"-man-page i have
>> installed, but nonetheless that is what it appears to do.
>> So assuming there are no incompatibilites between filesystems, the
>> information appears to come "free" with the stat(s) that ls has to do
>> anyway. (In the sense that there doesn't appear to any excessive
>> overhead involved, especially no additional I/O).
>> So i would say: definitly.
> `strace lsattr ...` shows it calls ioctl (...FS_IOC_GETFLAGS...)
> So there would be overhead.
> The output of ls is fairly constrained too for compat reasons.
> However these flags are not specific to ext2 so it would fit
> quite well from that perspective.
> It might be something we could add to the stat command at least?
Well, "ls" already displays information about POSIX ACLs by putting
a "+" after the UNIX permission bits. Some other UNIXen (such as
Mac OS X) seem to use an "@" character to indicate xattrs or other
forks of a file, so perhaps it would not be too inappropriate to throw
an "@" symbol on a file for ext3 immutable bits and such.
The question is what to do if something has both ACLs and
ext3 attributes; should it get both characters? Just one?
Perhaps a unique character?
I dunno... Just food for thought...