Re: ext3 hacked filesystem (by debian exim4 exploit) available foranalysis and bugreporting

[Luke Kenneth Casson Leighton]

On Fri, Jul 29, 2011 at 8:59 PM, Pavel Machek <pavel@xxxxxx> wrote:
> On Mon 2011-07-25 22:08:24, Luke Kenneth Casson Leighton wrote:
> [...]
>> On Mon, Jul 25, 2011 at 2:45 PM, Matthias Schniedermeyer <ms@xxxxxxx> wrote:
>>> You did try lsattr and checked that the files aren't 'immutable'?
>>
>> Âi didn't! :) Âdidn't know about (but should have guessed) ext3
>> attributes. Âthey are indeed - thank you matthias.
>> [...]

> Should ls -l be moddified to show something when file has immutable
> (and friends) set?
> Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â Â ÂPavel

 +1 on that.  i've been using unix systems for 20 years, and had
absolutely no visual clue that there were ext3 attributes, from doing
"ls -altr", my usual "fingers-pre-programmed" command.

 i would say that something like "+" on the attributes -rwxrwx---+
would intuitively say "there's more!" but it would be very helpful for
its background to e.g. be in red [on ls --color].  that would
definitely grab peoples' attention in a "wtf is that??" way.

 yeah. whatever symbol is chosen, i believe that some sort of
eye-burning background colour would be more important, forcing people
to go "ls --help" or "man ls".

 my only concern with adding yet more attribute-markers is all the
commands that parse "ls -a" output.  well... t'be'honest... i think if
selinux attribute markers have already been added, then that bullet
has already been bitten once, so it's not as big a hairy deal as all
that.

peace.

l.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/