News for hackers. Stuff that matters.

A comment on An lsof Primer.

Re:An lsof Primer by Udo on Monday October 10, 2011 @12:57PM (#3094625)
It's a good article. Beware though:

  lsof +L1 shows you all open files that have a link count less than 1, 
  often indicative of a cracker trying to hide something
On OS X, lsof +L1 returns tons of files, this is normal.
[ Parent | on HN ]
Re:An lsof Primer by ratbr on Monday October 10, 2011 @02:10PM (#3095017)
Thank you. I was a little concerned when my MBP spewed out a list with this option. I tried a little look-up on why that is normal.

From the manpage:

When +L is followed by a number, only files having a link count less than that number will be listed. (No number may follow -L.) A specification of the form ``+L1'' will select open files that have been unlinked. A specification of the form ``+aL1 <file_system>'' will select unlinked open files on the specified file system.

On my MBP (SL) at least, all the files listed with +L1 are from /private/var/folders/

A quick search seems to hint that this is the location to store secure caches and temp files for Snow Leopard.

[ Parent | on HN ]
Re:An lsof Primer by sc68cal on Monday October 10, 2011 @01:02PM (#3094669)
Indeed - this also indicates files that have deletion pending. A UNIX greybeard warned me about this as I was exploring the getdirentries() syscall.
[ Parent | on HN ]
Re:An lsof Primer by iceberg on Tuesday October 11, 2011 @12:03PM (#3099111)
Why would "lsof +L1" possibly signify "a cracker trying to hide something"? I'm wondering becuase I have lots(!) of results for this command.
[ Parent | on HN ]