8

Here's an odd problem I've had for a while. Every so often, I find that I have several jpeg images sitting in my home directory that I didn't put there. I'm fairly sure this isn't a security breach but rather, there's something writing these files in there that I've forgotten about.

Here's what I'm looking at today:

oli@bert:~$ ls -l *.jpg
-rw------- 1 oli oli  8061 2010-11-19 18:30 An-alien-from-Mars-Attack-002.jpg
-rw------- 1 oli oli 24362 2010-11-19 18:30 An-alien-from-Mars-Attack-006.jpg
-rw------- 1 oli oli  8147 2010-11-05 18:08 Avatar-Film---2009-002.jpg
-rw------- 1 oli oli 35602 2010-11-05 18:08 Avatar-Film---2009-006.jpg
-rw------- 1 oli oli  6058 2010-12-03 18:42 Britney-Spears-victim-of--002.jpg
-rw------- 1 oli oli 28330 2010-12-03 18:42 Britney-Spears-victim-of--006.jpg
-rw------- 1 oli oli  8135 2010-11-12 19:19 charlie-brooker-twitter-p-002.jpg
-rw------- 1 oli oli 22115 2010-11-12 19:19 charlie-brooker-twitter-p-006.jpg
-rw------- 1 oli oli  8059 2010-10-29 18:47 Leonardo-DiCaprio-002.jpg
-rw------- 1 oli oli 29988 2010-10-29 18:47 Leonardo-DiCaprio-006.jpg
-rw------- 1 oli oli  8064 2010-10-22 16:41 Spot-the-difference-.-.-.-002.jpg
-rw------- 1 oli oli 29188 2010-10-22 16:41 Spot-the-difference-.-.-.-006.jpg

They all seem like they're TV or film related... But I honestly don't have a clue what could be writing them. They don't bother me enough to go on a full-scale witch hunt but if anybody knows of something that writes images in the home directory like this, please let me know.

Seth
  • 57,282
  • 43
  • 144
  • 200
Oli
  • 289,791
  • 117
  • 680
  • 835
  • What software do you use to watch TV? You may be accidentally pressing the snapshot button. – badp Dec 12 '10 at 15:30
  • 1
    They seem to come from http://www.guardian.co.uk - maybe a browser plugin gone haywire? – htorque Dec 12 '10 at 15:31
  • You can use http://www.tineye.com/ to try identify where they came from originally – 8128 Dec 12 '10 at 15:39
  • @badp I don't watch TV on this computer, although I have in the past. I still have `gnome-dvb-client`, `gnome-dvb-daemon` and `totem-plugins-dvb-daemon` installed although I'm sure I've been getting these files longer than I've ever had those installed. Edit: I've just removed them – Oli Dec 12 '10 at 17:43
  • 2
    @htorque I do visit the Guardian website every once in a while. I'll visit it now in a couple of browsers and see if any new files get saved. – Oli Dec 12 '10 at 17:47
  • Your files have specific time-stamp detail. Can't you recall what was going on at these times with your machine (assuming you are the only one using it). There has to be a single app using your HOME as its target point. – nik Dec 13 '10 at 14:23
  • @nik That's a good observation but it's also an odd thing. In the evening, I tend to not use the computer... Especially between 5pm and 7pm, I'll be away from it, watching telly, making dinner, etc. – Oli Dec 13 '10 at 15:10
  • It's also interesting that the files are only saved on Fridays. The mask is also not typical, I hear that FF4.0 does this when saving files. I'd also suggest looking at the images' metadata, there can be some more info. – arrange Feb 23 '11 at 21:20
  • Hey Oli, still having this befuddling issue? – jrg Sep 02 '11 at 19:54
  • @jrg - desktop has been in headless/X-less mode for a month and has only just come back online but yes, it's still happening. Nothing from when it was in headless mode, suggesting it's something within my graphical session that's doing it. – Oli Sep 07 '11 at 13:26
  • @Oli OK, that's odder than odder than odd. – jrg Sep 07 '11 at 17:17
  • 1
    You wouldn't happen to have a toddler, a cat or another creature that would trigger some "save" feature of a browser left running on the foreground? – taneli Jan 09 '12 at 20:28

3 Answers3

3

No amount of investigation actually solved this but I did stop using Liferea and started using Lightread for reading my RSS feeds. The images stopped popping up.

Oli
  • 289,791
  • 117
  • 680
  • 835
  • I guess that solves the mystery. – jokerdino Sep 04 '12 at 12:44
  • I would say Liferea uses your home as image cache for stuff. – Braiam Feb 16 '14 at 16:10
  • That was my assumption but it wasn't consistent. It was as if only *some* of one feed's images were being fetched into the wrong place (as if there were an unescaped relative path like `../../../img.jpg`) but I never got around to reporting it because I never had the proof. – Oli Feb 16 '14 at 17:52
2

You can try running fatrace (see this answer) and when those images appear again, search for them in fatrace's log file. That hopefully will reveal the program that's acting up. :)

Community
  • 1
htorque
  • 63,950
  • 40
  • 194
  • 219
1

I don't think this is possible at the moment. I had a look into inotify and back in 2008 a developer wanted to put the PID of the process that created the file event into the cookie information. This would have solved it as you could have created a python program to grab the name of the process with that PID... in fact I created just a script to test the idea.

But the patch was thrown out for security reasons and a second patch may or may not have been submitted which needs some kind of options flag which isn't in pyinofity anyway.

So then I looked at lsof, it's a one shot deal so it's likely to miss the perp most of the time, but you might get lucky with or with the additional -r 1 to repeat every 1 second.

lsof +d ~/

At any rate this is a bit of a missing functionality in the workings of Linux and should probably be fixed. Report a bug to the Linux kernel and/or inotify explaining that a command line tool to watch for which processes are writing files would be most welcome.

Seth
  • 57,282
  • 43
  • 144
  • 200
Martin Owens -doctormo-
  • 19,860
  • 4
  • 63
  • 103