Re: ext3 hacked filesystem (by debian exim4 exploit) available foranalysis and bugreporting

[Luke Kenneth Casson Leighton]

On Mon, Jul 25, 2011 at 2:45 PM, Matthias Schniedermeyer <ms@xxxxxxx> wrote:
> On 25.07.2011 13:08, Luke Kenneth Casson Leighton wrote:
>> folks, hi,
>>
>> apart from anything, files which cannot be deleted (and cannot be
>> detected as "corrupted" by fsck.ext3) is pretty damn serious.
>
> You did try lsattr and checked that the files aren't 'immutable'?

 i didn't! :)  didn't know about (but should have guessed) ext3
attributes.  they are indeed - thank you matthias.

root@quietbaby:/mnt/horsebox/tmp3# lsattr *
----ia------------- bin3/kill
----ia------------- bin3/ps
----ia------------- c.pl
----ia------------- e.conf
----ia------------- sbin3/sysctl
----ia------------- usrbin3/uptime
----ia------------- usrbin3/tload
----ia------------- usrbin3/free
----ia------------- usrbin3/top
----ia------------- usrbin3/vmstat
----ia------------- usrbin3/watch
----ia------------- usrbin3/skill
----ia------------- usrbin3/pmap
----ia------------- usrbin3/pgrep
----ia------------- usrbin3/slabtop
----ia------------- usrbin3/pwdx
----ia------------- usrbin3/snice
----ia------------- usrbin3/pkill
----ia------------- usrbin3/w

so - looks like it's not as bad as i thought.

apologies for taking up peoples' time with this.

 l.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/