empty dir with + attribute

jeffschips

• November 23, 2023 09:44

Hello. I hope everyone is safe and healthy and enjoying the holiday. I have a directory with notations as below. the + attribute supposedly means special attributes for a file, but the directory is (supposedly) empty. Maybe someone can elaborate on this? root@xxxx:/media# ls -la total 12 drwxr-xr-x 3 root root 4096 Nov 23 10:32 . drwxr-xr-x 20 root root 4096 Oct 9 15:33 .. drwxr-x---+ 2 root root 4096 Nov 22 21:26 xxxx root@xxxx:/media# pwd /media

• 

  docw

  • December 02, 2023 20:39

  Extended attributes can be applied to files and directories (so it's perfectly possible that the directory is empty).

  For a directory, you can list extended attributes with `lsattr -d [directory]`. So, for your xxxx directory you can run:

  lsattr -d xxxx

  There are lots of different attributes a file or directory can have. You can get a full list via the man page for `chattr` (which is the utility used to change attributes):

  man 1 chattr

  Most commonly, chattr is used to make files or directories immutable. In that case the output would look like this:

  ----i----------------- xxxx

  The "i" is the "immutable flag. To remove that attribute you can then run:

  chattr -i xxxx

  As cPRex said, cPanel won't have set any extended attributes. I have seen files with the immutable attribute set on hacked websites, so it's worth checking if the directory is legit.

  1
• 

  cPRex Jurassic Moderator

  • November 23, 2023 18:55

  Hey hey! Safe, yes. Healthy...not entirely! "+" is "alternate access methods" for the file, such as an access control list. This wouldn't be anything created by cPanel, though, so I can't say for sure where it would have come from.

  0
• 

  jeffschips

  • November 23, 2023 20:05

  Hi cPRex Glad to hear safe, but also wishing you better health, too. Could you elaborate on the "+". I don't understand if it applies to file and if so what are the implications on what that file can or cannot do. Oddly, there are no files in the directory where I see this. Unless they are somehow hidden or the "+" is a reminant of what was there. Is it safe to remove that access type and if so, how would that be done? Oh, and wishing you feel better, too.

  0

Please sign in to leave a comment.