I've been in similar situations countless times, but this one is
throwing me a for a loop.
I have a file that I'm trying to remove with non-printable characters
in the name. Additionally, some of the characters appear to be
backspace/delete/etc.
All my normal tricks with rm(1) fail.
Using vim on the directory to try and delete the entry fails.
I can get the inode of the file with ls(1), and used that to write the
following program which I thought would help, but sadly it too fails.
#include <stdio.h>
#include <sys/types.h>
#include <dirent.h>
#include <err.h>
#include <unistd.h>
int main(void)
{
/* open directory */
DIR *usr;
if ((usr = opendir("/usr")) == NULL)
err(1, "failed to opendir");
/* read through until we find the evil one... */
struct dirent *entry;
while ((entry = readdir(usr)) != NULL)
{
/* check against known evil inode */
if (entry->d_fileno == 1065344)
{
/* got it */
printf("found file...name length is: %d\n", entry->d_namlen);
/* build filename as a char* */
uint8_t i;
for (i = 0; i < entry->d_namlen; i++)
printf("%d ", entry->d_name[i]);
/* cross fingers */
printf("\n\nattempting to unlink...\n");
if (unlink(entry->d_name) < 0)
err(1, "failure, crack 'nother beer");
}
}
closedir(usr);
return 0;
}
the program outputs the following:
found file...name length is: 194
-104 38 13 40 -22 101 -13 -4 -68 -107 69 86 49 -92 69 37 -90 -95 -52
20 27 -104 -24 -60 82 -49 46 -50 79 -70 23 -30 66 -29 56 89 29 -100
-127 59 83 -115 28 26 -121 30 81 -45 67 -53 -100 -76 103 15 109 -88 17
95 69 -102 87 -35 -41 -83 -13 -18 9 62 76 44 -52 99 33 -5 39 79 -100
49 -111 6 -64 -94 -97 19 -10 34 104 -87 100 28 125 4 -52 -101 84 -85
85 92 13 -2 -84 -11 63 125 -1 119 -67 82 27 96 -113 -79 -1 84 -87 -43
55 -14 -1 53 -124 69 -29 -65 74 27 96 -113 -71 -1 -111 75 -91 -51 -8
-81 33 -120 -58 127 85 54 -64 30 115 -1 83 44 -41 55 -25 -65 53 -124
-51 -3 -49 -41 29 -60 -12 -65 26 27 96 -39 -9 63 114 66 -2 91 -86 -105
54 -12 -65 -122 -80 104 -4 55 60 -31 -21 8 66 -6 95 -111 13 -80 44 -6
attempting to unlink...
a.out: failure, crack 'nother beer: No such file or directory
Questions:
1. Any whacks of a clue-stick would be greatly appreciated.
2. When I printf dirent struct's d_namlen field, is says 302...
grep'ing /usr/include, isn't this 255? How can this happen?
3. Passing the d_name field directly to unlink(2)... this should
work, correct? (I tried this with a sample setup elsewhere and it
did). Any thoughts why this would fail?
To those who are curious, the file was created when I went to unpack a
ports.tar.gz and forgot the 'z' switch... d'oh.
Anyway, I could try deleting the parent directory, but it's /usr.
-Ryan
