Dev1 Galaxy Forum / [SOLVED] File "recently-used.xbel"

Re: [SOLVED] File "recently-used.xbel"

dummy@example.com (delgado) — Sat, 03 Jun 2023 11:29:28 +0000

Excellent - Thanks a lot, guys!

And something learned again.

Re: [SOLVED] File "recently-used.xbel"

dummy@example.com (alexkemp) — Fri, 02 Jun 2023 23:18:05 +0000

steve_v wrote:

Setting the immutable bit in extended attributes should also work - chattr +i [filename] as root.

Works perfect. Perhaps, a touch too perfect for some scenarios. But perfect to stop ALL deletions.

~$ man chattr
NAME
       chattr - change file attributes on a Linux file system
…
ATTRIBUTES
…
       i      A  file  with  the 'i' attribute cannot be modified: it cannot be deleted or renamed, no link can be created to this
              file, most of the file's metadata can not be modified, and the file can not be opened in write mode.  Only the supe‐
              ruser or a process possessing the CAP_LINUX_IMMUTABLE capability can set or clear this attribute.

~$ mkdir TMP
~$ cd TMP
~/TMP$ echo "a" > tmp.txt
~/TMP$ la tmp.txt
-rw-r--r-- 1 alexk alexk    2 Jun  3 00:04 tmp.txt
~/TMP$ sudo chown root.root tmp.txt
[sudo] password for alexk: 
~/TMP$ sudo chattr +i tmp.txt
~/TMP$ la tmp.txt
-rw-r--r-- 1 root root 2 Jun  3 00:04 tmp.txt
~/TMP$ chmod 0700 tmp.txt
chmod: changing permissions of 'tmp.txt': Operation not permitted
~/TMP$ sudo chmod 0700 tmp.txt
chmod: changing permissions of 'tmp.txt': Operation not permitted
~/TMP$ rm tmp.txt
rm: cannot remove 'tmp.txt': Operation not permitted
~/TMP$ sudo chattr -i tmp.txt
~/TMP$ sudo chmod 0700 tmp.txt
~/TMP$ la tmp.txt
-rwx------ 1 root root 2 Jun  3 00:04 tmp.txt
~/TMP$ rm tmp.txt
rm: remove write-protected regular file 'tmp.txt'? y
~/TMP$ cd -
/home/alexk
~$ rmdir TMP

Re: [SOLVED] File "recently-used.xbel"

dummy@example.com (steve_v) — Fri, 02 Jun 2023 22:45:01 +0000

Setting the immutable bit in extended attributes should also work - chattr +i [filename] as root.

Re: [SOLVED] File "recently-used.xbel"

dummy@example.com (boughtonp) — Fri, 02 Jun 2023 22:22:47 +0000

chris2be8 wrote:

You might be able to stop this by making .local/share/ owned by root. But this would break anything else trying to create a file in .local/share/

AppArmor is supposed to be able to limit file permissions on a per-executable basis, but first need to figure out what the offending application is.

inotifywait can be used to confirm when files are created/modified, which may help track down the cause.

Re: [SOLVED] File "recently-used.xbel"

dummy@example.com (alexkemp) — Fri, 02 Jun 2023 17:00:01 +0000

I was astonished that an ordinary user can delete a file owned by root, but yes it can (if the dir is owned by the user):

$ echo "a" > tmp.txt
$ la tmp.txt
-rw-r--r-- 1 alexk alexk     2 Jun  2 17:48 tmp.txt
$ chmod 0700 tmp.txt
$ la tmp.txt
-rwx------ 1 alexk alexk 2 Jun  2 17:48 tmp.txt
$ sudo chown root.root tmp.txt
[sudo] password for alexk: 
$ la tmp.txt
-rwx------ 1 root root 2 Jun  2 17:48 tmp.txt
$ rm tmp.txt
rm: remove write-protected regular file 'tmp.txt'? y
$ la tmp.txt
ls: cannot access 'tmp.txt': No such file or directory

Re: [SOLVED] File "recently-used.xbel"

dummy@example.com (delgado) — Fri, 02 Jun 2023 16:19:47 +0000

Thanks for the info - I was not aware of that possibilty.

At least there is nothing strange happening, as thought before.

Re: [SOLVED] File "recently-used.xbel"

dummy@example.com (chris2be8) — Fri, 02 Jun 2023 16:03:57 +0000

The program that re-creates it probably deletes it before re-writing the latest contents into it. If you own .local/share/ then a program, running as you can delete files from it, even if you don't own them.

You might be able to stop this by making .local/share/ owned by root. But this would break anything else trying to create a file in .local/share/

[SOLVED] File "recently-used.xbel"

dummy@example.com (delgado) — Fri, 02 Jun 2023 15:05:50 +0000

It is a log of recently used files. There is some kind of standard form gnome / freedesktop.org. Let's say I don't want that:
The file is created if not existing, which is to expect. Then I recreated it read-only, and then read-only owned by root. This bloody thing always re-apperars with new content (see code-block below). Especially the last case is something I do not like at all. Meanwhile, I think it is dconf-service, but not sure; apt says it is neded by gtk3.
How to tame that beast?

$ cat .local/share/recently-used.xbel
'recently-used.xbel' is owned by root now, and contains this line.
$ ls -la .local/share/recently-used.xbel
-r--r--r-- 1 root root 67 2023-06-02 16:01 .local/share/recently-used.xbel
# 20 minutes later
$ ls -la .local/share/recently-used.xbel
-rw------- 1 tom tom 1473 2023-06-02 16:15 .local/share/recently-used.xbel