What does 'plus' in ls -Z mean?

[Ling Li]

Some files/directories have '+' when they are displayed with ls -Z. For example,
# ls -dZ /lost+found/
drwx------+ root     root     system_u:object_r:lost_found_t   /lost+found/

What does the '+' after the mode 'rwx------' mean?

--Ling

[Russell Coker]

On Mon, 7 Jun 2004 16:26, Ling Li <liling(a)gmail.com&gt; wrote:
>  Some files/directories have '+' when they are displayed with
> ls -Z. For
>  example, # ls -dZ /lost+found/
>  drwx------+ root     root     system_u:object_r:lost_found_t   /lost+found/
>
>  What does the '+' after the mode 'rwx------' mean? 
> From the SE Linux patch to ls.c: 
+    modebuf[10] =
(FILE_HAS_ACL (f) ? '+' : ' ');

I have repeated the same test on my system and found a '+' entry when it's not

appropriate.  I have verified that the directory in question has no acl, and 
also verified that /bin/ls does not even check for the presence of an acl by 
stracing it and seeing that it did not query the "system.posix_acl_access" or 
"system.posix_acl_default" xattrs, and it did not call listxattr() (to 
determine whether those xattr's existed).

At the moment I believe that there is some memory corruption in the SE Linux 
code.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[Stephen Smalley]

On Mon, 2004-06-07 at 08:36, Russell Coker wrote:
>  >From the SE Linux patch to ls.c:
>  +    modebuf[10] = (FILE_HAS_ACL (f) ? '+' : ' '); 
That is copied from the corresponding code for computing the mode string
in print_long_format.  In turn, FILE_HAS_ACL is based on the f->have_acl
flag.  But f->have_acl is only assigned a value if format == long_format
in gobble_file().  Hence, the flag is not getting initialized properly
for the security_format.  Patch below should fix.

--- ls.c.old	2004-06-07 08:51:24.000000000 -0400
+++ ls.c	2004-06-07 08:51:34.000000000 -0400
@@ -2528,7 +2528,7 @@
 	}
 
 #if HAVE_ACL || USE_ACL
-      if (format == long_format)
+      if (format == long_format || format == security_format)
 	{
 	  int n = file_has_acl (path, &f->stat);
 	  f->have_acl = (0 < n);

-- 
Stephen Smalley <sds(a)epoch.ncsc.mil&gt;
National Security Agency

[Russell Coker]

On Mon, 7 Jun 2004 22:52, Stephen Smalley <sds(a)epoch.ncsc.mil&gt; wrote:
>  On Mon, 2004-06-07 at 08:36, Russell Coker wrote:
>  > >From the SE Linux patch to ls.c:
>  >
>  > +    modebuf[10] = (FILE_HAS_ACL (f) ? '+' : ' ');
>
>  That is copied from the corresponding code for computing the mode string
>  in print_long_format.  In turn, FILE_HAS_ACL is based on the f->have_acl
>  flag.  But f->have_acl is only assigned a value if format == long_format 
Great work!  I've filed the following bugzilla report.

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=125447

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

[Tim Waugh]

On Mon, Jun 07, 2004 at 11:13:48PM +1000, Russell Coker wrote:

>  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=125447 
I used a slightly different patch:

--- coreutils-5.2.1/src/ls.c	2004-06-04 09:55:05.010506573 +0100
+++ coreutils-5.2.1/src/ls.c	2004-06-07 14:18:07.448963915 +0100
@@ -2530,7 +2530,11 @@
 	}
 
 #if HAVE_ACL || USE_ACL
-      if (format == long_format)
+      if (format == long_format
+#ifdef WITH_SELINUX
+	  || format == security_format
+#endif
+	  )
 	{
 	  int n = file_has_acl (path, &f->stat);
 	  f->have_acl = (0 < n);

Fixed in coreutils-5.2.1-15.

Thanks,
Tim.
*/