I looked at some file list inconsistencies in a custom tool and
discovered several odd things related to ghost files.
A few packages contain hard-linked files where some of the names have
the ghost flag set, but others haven't. Probably the most prominent
example is binutils-2.23.51.0.1-6.fc18.x86_64:
-rwxr-xr-x (g) 7 root root 2908152 /usr/bin/ld
-rwxr-xr-x () 7 root root 2908152 /usr/bin/ld.gold
(The --qf output format is '[%{filemodes:perms} (%{fileflags:fflags})
%{fileinodes} %{fileusername} %{filegroupname} %{filesizes}
%{filenames}\n]'.)
Symlinks with ghost status are fairly common. Here's an example from
util-linux-2.22.2-6.fc18.x86_64.rpm:
lrwxrwxrwx (cmng) 1 root root 12 /etc/mtab
(I'm attaching the full list for Fedora/18/i686.)
The next thing is very odd. xulrunner-devel-21.0-4.fc18.x86_64 contains
ghost files which are present in the CPIO archive:
-rw-r--r-- (g) 3055 root root 490 /usr/lib64/xulrunner/js-gdb.pyc
-rw-r--r-- (g) 3055 root root 490 /usr/lib64/xulrunner/js-gdb.pyo
rpm2cpio | cpio -tv shows this:
-rw-r--r-- 2 root root 0 May 21 15:32
./usr/lib64/xulrunner/js-gdb.pyc
-rw-r--r-- 2 root root 490 May 21 15:32
./usr/lib64/xulrunner/js-gdb.pyo
(Both files have the same inode number, so they are hard linked to each
other.)
--
Florian Weimer / Red Hat Product Security Team