Re: ext3 hacked filesystem (by debian exim4 exploit) available foranalysis and bugreporting

[Kyle Moffett]

2011/7/29 PÃdraig Brady <P@xxxxxxxxxxxxxx>:
>>> Should ls -l be moddified to show something when file has immutable
>>> (and friends) set?
>>
>> AFAICT lsattr, in e2fsprogs, only does a 'stat'(lib/e2p/fgetflags.c) and
>> checks st_flags, which i can't see in the "man 2 stat"-man-page i have
>> installed, but nonetheless that is what it appears to do.
>>
>> So assuming there are no incompatibilites between filesystems, the
>> information appears to come "free" with the stat(s) that ls has to do
>> anyway. (In the sense that there doesn't appear to any excessive
>> overhead involved, especially no additional I/O).
>>
>> So i would say: definitly.
>
> `strace lsattr ...` shows it calls ioctl (...FS_IOC_GETFLAGS...)
> So there would be overhead.
> The output of ls is fairly constrained too for compat reasons.
>
> However these flags are not specific to ext2 so it would fit
> quite well from that perspective.
> It might be something we could add to the stat command at least?

Well, "ls" already displays information about POSIX ACLs by putting
a "+" after the UNIX permission bits.  Some other UNIXen (such as
Mac OS X) seem to use an "@" character to indicate xattrs or other
forks of a file, so perhaps it would not be too inappropriate to throw
an "@" symbol on a file for ext3 immutable bits and such.

The question is what to do if something has both ACLs and
ext3 attributes; should it get both characters?  Just one?
Perhaps a unique character?

I dunno...  Just food for thought...

Cheers,
Kyle Moffett
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/