linux-kernel - Re: ext3 hacked filesystem (by debian exim4 exploit) available for analysis and bugreporting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGZ=bq+xewnb9UKEe-LxQgFs-L7uYm-349OKcn9Qq_1kXtL9Ag@mail.gmail.com>
Date:	Fri, 29 Jul 2011 22:47:14 -0400
From:	Kyle Moffett <kyle@...fetthome.net>
To:	Pádraig Brady <P@...igbrady.com>
Cc:	Matthias Schniedermeyer <ms@...d.de>, Pavel Machek <pavel@....cz>,
	Luke Kenneth Casson Leighton <lkcl@...l.net>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Coreutils <coreutils@....org>
Subject: Re: ext3 hacked filesystem (by debian exim4 exploit) available for
 analysis and bugreporting

2011/7/29 Pádraig Brady <P@...igbrady.com>:
>>> Should ls -l be moddified to show something when file has immutable
>>> (and friends) set?
>>
>> AFAICT lsattr, in e2fsprogs, only does a 'stat'(lib/e2p/fgetflags.c) and
>> checks st_flags, which i can't see in the "man 2 stat"-man-page i have
>> installed, but nonetheless that is what it appears to do.
>>
>> So assuming there are no incompatibilites between filesystems, the
>> information appears to come "free" with the stat(s) that ls has to do
>> anyway. (In the sense that there doesn't appear to any excessive
>> overhead involved, especially no additional I/O).
>>
>> So i would say: definitly.
>
> `strace lsattr ...` shows it calls ioctl (...FS_IOC_GETFLAGS...)
> So there would be overhead.
> The output of ls is fairly constrained too for compat reasons.
>
> However these flags are not specific to ext2 so it would fit
> quite well from that perspective.
> It might be something we could add to the stat command at least?

Well, "ls" already displays information about POSIX ACLs by putting
a "+" after the UNIX permission bits.  Some other UNIXen (such as
Mac OS X) seem to use an "@" character to indicate xattrs or other
forks of a file, so perhaps it would not be too inappropriate to throw
an "@" symbol on a file for ext3 immutable bits and such.

The question is what to do if something has both ACLs and
ext3 attributes; should it get both characters?  Just one?
Perhaps a unique character?

I dunno...  Just food for thought...

Cheers,
Kyle Moffett
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/