[GIT,PULL,11/23] xfs_scrub: detect deceptive filename extensions

Message ID	172230458858.1455085.1385987165268927699.stg-ugh@frogsfrogsfrogs (mailing list archive)
State	Accepted, archived
Headers	show Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4182E145B35 for <linux-xfs@vger.kernel.org>; Tue, 30 Jul 2024 02:43:10 +0000 (UTC) Date: Mon, 29 Jul 2024 19:43:10 -0700 Subject: [GIT PULL 11/23] xfs_scrub: detect deceptive filename extensions From: "Darrick J. Wong" <djwong@kernel.org> To: cem@kernel.org, djwong@kernel.org Cc: hch@lst.de, linux-xfs@vger.kernel.org Message-ID: <172230458858.1455085.1385987165268927699.stg-ugh@frogsfrogsfrogs> Precedence: bulk MIME-Version: 1.0 In-Reply-To: <20240730013626.GF6352@frogsfrogsfrogs> References: <20240730013626.GF6352@frogsfrogsfrogs> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit
Series	[GIT,PULL,01/23] libxfs: fixes for 6.9 \| expand [GIT,PULL,01/23] libxfs: fixes for 6.9 [GIT,PULL,02/23] libxfs: sync with 6.10 [GIT,PULL,03/23] xfsprogs: atomic file updates [GIT,PULL,04/23] xfsprogs: set and validate dir/attr block owners [GIT,PULL,05/23] xfsprogs: inode-related repair fixes [GIT,PULL,06/23] xfs_scrub: fixes to the repair code [GIT,PULL,07/23] xfs_scrub: improve warnings about difficult repairs [GIT,PULL,08/23] xfs_scrub: track data dependencies for repairs [GIT,PULL,09/23] xfs_scrub: use scrub_item to track check progress [GIT,PULL,10/23] xfs_scrub: improve scheduling of repair items [GIT,PULL,11/23] xfs_scrub: detect deceptive filename extensions [GIT,PULL,12/23] xfs_scrub: move fstrim to a separate phase [GIT,PULL,13/23] xfs_scrub: use free space histograms to reduce fstrim runtime [GIT,PULL,14/23] xfs_scrub: tighten security of systemd services [GIT,PULL,15/23] xfs_scrub_all: automatic media scan service [GIT,PULL,16/23] xfs_scrub_all: improve systemd handling [GIT,PULL,17/23] xfsprogs: improve extended attribute validation [GIT,PULL,18/23] xfsprogs: Parent Pointers [GIT,PULL,19/23] xfsprogs: scrubbing for parent pointers [GIT,PULL,20/23] xfsprogs: offline repair for parent pointers [GIT,PULL,21/23] xfsprogs: detect and correct directory tree problems [GIT,PULL,22/23] xfs_scrub: vectorize kernel calls [GIT,PULL,23/23] xfs_repair: fixes for kernel 6.10

Message ID

172230458858.1455085.1385987165268927699.stg-ugh@frogsfrogsfrogs (mailing list archive)

State

Accepted, archived

Headers

Date: Mon, 29 Jul 2024 19:43:10 -0700
Subject: [GIT PULL 11/23] xfs_scrub: detect deceptive filename extensions
From: "Darrick J. Wong" <djwong@kernel.org>
To: cem@kernel.org, djwong@kernel.org
Cc: hch@lst.de, linux-xfs@vger.kernel.org
Message-ID: <172230458858.1455085.1385987165268927699.stg-ugh@frogsfrogsfrogs>
Precedence: bulk
MIME-Version: 1.0
In-Reply-To: <20240730013626.GF6352@frogsfrogsfrogs>
References: <20240730013626.GF6352@frogsfrogsfrogs>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

Series

[GIT,PULL,01/23] libxfs: fixes for 6.9 | expand

Message

Darrick J. Wong July 30, 2024, 2:43 a.m. UTC

Hi Carlos,

Please pull this branch with changes for xfsprogs for 6.10-rc1.

As usual, I did a test-merge with the main upstream branch as of a few
minutes ago, and didn't see any conflicts.  Please let me know if you
encounter any problems.

The following changes since commit 474ff27d466c053f1cd51024e6b0c5a741a2d4bd:

xfs_scrub: try to repair space metadata before file metadata (2024-07-29 17:01:08 -0700)

are available in the Git repository at:

https://git.kernel.org/pub/scm/linux/kernel/git/djwong/xfsprogs-dev.git tags/scrub-detect-deceptive-extensions-6.10_2024-07-29

for you to fetch changes up to 746ee95b71649b4ae515893ffa3bbe7b5e815d0d:

xfs_scrub: dump unicode points (2024-07-29 17:01:09 -0700)

----------------------------------------------------------------
xfs_scrub: detect deceptive filename extensions [v30.9 11/28]

In early 2023, malware researchers disclosed a phishing attack that was
targeted at people running Linux workstations.  The attack vector
involved the use of filenames containing what looked like a file
extension but instead contained a lookalike for the full stop (".")
and a common extension ("pdf").  Enhance xfs_scrub phase 5 to detect
these types of attacks and warn the system administrator.

This has been running on the djcloud for months with no problems.  Enjoy!

Signed-off-by: Darrick J. Wong <djwong@kernel.org>

----------------------------------------------------------------
Darrick J. Wong (13):
xfs_scrub: use proper UChar string iterators
xfs_scrub: hoist code that removes ignorable characters
xfs_scrub: add a couple of omitted invisible code points
xfs_scrub: avoid potential UAF after freeing a duplicate name entry
xfs_scrub: guard against libicu returning negative buffer lengths
xfs_scrub: hoist non-rendering character predicate
xfs_scrub: store bad flags with the name entry
xfs_scrub: rename UNICRASH_ZERO_WIDTH to UNICRASH_INVISIBLE
xfs_scrub: type-coerce the UNICRASH_* flags
xfs_scrub: reduce size of struct name_entry
xfs_scrub: rename struct unicrash.normalizer
xfs_scrub: report deceptive file extensions
xfs_scrub: dump unicode points

scrub/unicrash.c | 532 ++++++++++++++++++++++++++++++++++++++++++++-----------
1 file changed, 426 insertions(+), 106 deletions(-)

[GIT,PULL,11/23] xfs_scrub: detect deceptive filename extensions

Pull-request

Message