linux-kernel - Re: ext3 hacked filesystem (by debian exim4 exploit) available for analysis and bugreporting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPweEDzExzvt+G7_3UanFM+PJEpsuOh8Qnu-YRanNo+Bm-0o5w@mail.gmail.com>
Date:	Sat, 30 Jul 2011 14:03:34 +0100
From:	Luke Kenneth Casson Leighton <lkcl@...l.net>
To:	Jim Meyering <jim@...ering.net>
Cc:	Pádraig Brady <P@...igbrady.com>,
	Matthias Schniedermeyer <ms@...d.de>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Pavel Machek <pavel@....cz>, Coreutils <coreutils@....org>
Subject: Re: ext3 hacked filesystem (by debian exim4 exploit) available for
 analysis and bugreporting

On Sat, Jul 30, 2011 at 10:14 AM, Jim Meyering <jim@...ering.net> wrote:
> Pádraig Brady wrote:
> ...
>> `strace lsattr ...` shows it calls ioctl (...FS_IOC_GETFLAGS...)
>> So there would be overhead.
>> The output of ls is fairly constrained too for compat reasons.

 well if that rule has been broken once for selinux (adding extra
symbols) then it can be broken again.

> One way by which ls -l could inform us that a file has
> "attributes" like that would be via what POSIX calls the
> "optional alternate access method flag".  Currently,
> it can be a space, a "+", or a ".":

 i'd advocate, when the ls --color option is set, changing the
background to something attention-grabbing (e.g. red).  it's far too
easy to miss an extra symbol otherwise, and "+", although intuitively
saying "there's more than meets the eye, here" is too similar to a
line of "-"s to really make people sit up and take notice.  i'd
certainly go "oh look, there's a +, how pretty", but a + on a red
background i might just stop and think, "eh? i no unnerstan, let's
look up man page or call some friends".

 l.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/