LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 11-19-2023, 04:46 AM   #16
Petri Kaukasoina
Senior Member
 
Registered: Mar 2007
Posts: 1,903

Rep: Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551

Quote:
Originally Posted by compis View Post
Anyone who knows the answer would be able to give an example of how a directory file can change from 4096 to a larger value.
Yes, in post #12, Michael gave an actual example: He created 150 files in a directory and then deleted them. The filesystem can't fit the needed structures for 150 filenames in 4096 bytes, and the directory became 12288 bytes.

There are programs which create a lot of temporary files.

Quote:
Originally Posted by compis View Post
an example is the app vocal it placed a cache file that was bigger than 4096.

What is occurring ? I can see no reason for the size of a directory to change and if there is a reason what is it
You say cache, don't you? I seem to have a directory ~/.cache/mozilla/firefox/????????.default/cache2/entries with a size of 77824. There are (or has been) so many files that 77824 is needed. Even if I cleared the cache, it would stay at 77824.
 
Old 11-19-2023, 05:14 AM   #17
Petri Kaukasoina
Senior Member
 
Registered: Mar 2007
Posts: 1,903

Rep: Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551Reputation: 1551
Quote:
Originally Posted by pan64 View Post
You can still put in 50 files, 127, 151, 152 or even 10,000 files, remove [some] files and see how it works.
Code:
$ mkdir test;ls -ld test;for((C=0;C<10000;C++))do>test/$C;done;rm -f test/*;ls -ld test
drwxr-xr-x 2 compis users 4096 2023-11-19 13:05 test
drwxr-xr-x 2 compis users 262144 2023-11-19 13:05 test
There is a -D option for e2fsck:
Code:
       -D     Optimize  directories in file system.  This option causes e2fsck
              to try to optimize all directories, either by  re-indexing  them
              if  the  file system supports directory indexing,  or by sorting
              and compressing directories for smaller directories, or for file
              systems using traditional linear directories.

              Even  without the -D option, e2fsck may sometimes optimize a few
              directories --- for example, if directory  indexing  is  enabled
              and  a directory is not indexed and would benefit from being in-
              dexed, or if the index structures are corrupted and need  to  be
              rebuilt.   The -D option forces all directories in the file sys-
              tem to be optimized.  This can  sometimes  make  them  a  little
              smaller  and  slightly  faster  to  search, but in practice, you
              should rarely need to use this option.

              The -D option will detect directory entries with duplicate names
              in  a  single  directory, which e2fsck normally does not enforce
              for performance reasons.

Last edited by Petri Kaukasoina; 11-19-2023 at 05:20 AM.
 
Old 11-19-2023, 05:38 AM   #18
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 22,021

Rep: Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343
Quote:
Originally Posted by compis View Post
Anyone who knows the answer would be able to give an example of how a directory file can change from 4096 to a larger value. So yes I believe this is hidden malware which no one noticed.
We have offered a way to reproduce the issue (change of the size of the directory, if I understand well). Also you can find the log of the execution in these posts.
Did you try them on your host? Can you compare your results to the one posted? Can you show us your results?
 
Old 11-19-2023, 10:22 AM   #19
dugan
LQ Guru
 
Registered: Nov 2003
Location: Canada
Distribution: distro hopper
Posts: 11,249

Rep: Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323
I think I know what’s going on. Compis isn’t aware that files that start a dot aren’t listed by “ls” unless you supply it a special flag.

Explains every one of his posts here.

(It is of course the case that every "suggestion" that he'd gotten was, indeed, "valid").

Quote:
Originally Posted by compis View Post
So yes I believe this is hidden malware which no one noticed.
See, you're not thinking before you post. How would such a malware execute? It would require a code execution vulnerability to be present in either the kernel or in glibc. As the definition of a directory has been explained to you many times, you should know this.

Now, can you find a single link, CVE, for example, to support your "belief" that there's a security issue here? Which you "stated"? No. So drop this silliness.

Last edited by dugan; 11-19-2023 at 06:07 PM.
 
Old 12-19-2023, 07:06 AM   #20
compis
Member
 
Registered: Sep 2023
Posts: 35

Original Poster
Rep: Reputation: 0
This problem has occurred again on mx linux 21.3. Notice how Pictures directory size changed from 4096 to 12288.


ls -l
total 44
drwxr-xr-x 8 Name Name 4096 Dec 15 23:54 Desktop
drwxr-xr-x 18 Name Name 4096 Dec 8 22:56 Documents
drwxr-xr-x 12 Name Name 4096 Dec 19 05:28 Downloads
drwxr-xr-x 3 Name Name 4096 Jun 23 03:14 Music
drwxr-xr-x 4 Name Name 12288 Dec 8 21:06 Pictures
drwxr-xr-x 2 Name Name 4096 Aug 12 18:11 Public
drwxr-xr-x 2 Name Name 4096 Aug 14 2022 Templates
drwxr-xr-x 2 Name Name 4096 Dec 14 23:03 Videos
drwxr-xr-x 7 Name Name 4096 Dec 18 05:55 'VirtualBox VMs'
 
Old 12-19-2023, 09:14 AM   #21
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 22,021

Rep: Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343Reputation: 7343
this is not a problem, this is how does it work. You cannot avoid that.
 
Old 12-20-2023, 02:02 PM   #22
dugan
LQ Guru
 
Registered: Nov 2003
Location: Canada
Distribution: distro hopper
Posts: 11,249

Rep: Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323Reputation: 5323
Obviously, the explanation is that files were added to the Pictures directory.

Putting compis on ignore now, as it's his own fault that still doesn't understand this.

Last edited by dugan; 12-20-2023 at 02:08 PM.
 
Old 12-20-2023, 06:47 PM   #23
michaelk
Moderator
 
Registered: Aug 2002
Posts: 25,777

Rep: Reputation: 5935Reputation: 5935Reputation: 5935Reputation: 5935Reputation: 5935Reputation: 5935Reputation: 5935Reputation: 5935Reputation: 5935Reputation: 5935Reputation: 5935
Quote:
This problem has occurred again on mx linux 21.3. Notice how Pictures directory size changed from 4096 to 12288.
See post #12. How many pictures are in the Pictures directory?
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Linux Virtual Memory size; Page size; Resident Data Size; DB2Database; Explanation ANanalanalyzer Linux - Newbie 1 09-28-2018 04:50 PM
ls command to list out the file names,directory(along which file is present), file details(size,date time) at one go amala15vsa Linux - Newbie 1 10-09-2017 11:37 AM
Directory Size of etc, lost+found vs regular directory size. dumblinuxuser Linux - Newbie 1 06-07-2016 09:52 AM
[SOLVED] Store the size of largest file from a file/directory listing into variable SIZE lainey Linux - Newbie 3 11-15-2011 12:29 PM
Total partition size - User partition size is not equals to Free partition size navaneethanj Linux - General 5 06-14-2004 12:55 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 10:28 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration