]> www.infradead.org Git - users/hch/xfstests-dev.git/commit
generic/453: check xfs_scrub detection of confusing job offers
authorDarrick J. Wong <djwong@kernel.org>
Tue, 27 Aug 2024 18:46:07 +0000 (11:46 -0700)
committerZorro Lang <zlang@kernel.org>
Mon, 2 Sep 2024 20:45:49 +0000 (04:45 +0800)
commitc63a6fe023531f7fb246c363d9e39e0ca1d6158a
treef433bd70c5c54ae04ff56dac91935130a96cddd4
parent1dbd10d1bbca6d67fca02754ee8ffab531892763
generic/453: check xfs_scrub detection of confusing job offers

Earlier this year, ESET revealed that Linux users had been tricked into
opening executables containing malware payloads.  The trickery came in
the form of a malicious zip file containing a filename with the string
"job offer․pdf".  Note that the filename does *not* denote a real pdf
file, since the last four codepoints in the file name are "ONE DOT
LEADER", p, d, and f.  Not period (ok, FULL STOP), p, d, f like you'd
normally expect.

Now that xfs_scrub can look for codepoints that could be confused with a
period followed by alphanumerics, let's make sure it actually works.

Link: https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack/
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Zorro Lang <zlang@kernel.org>
tests/generic/453