3

In /home// are, among others, the following entries. Can anyone tell me what these ”unknown” file types are? Are they legitimate?

.ICEauthority          2.4kB        unknown
.profile               675 bytes    plain text document
.pulse-cookie          256 bytes    unknown
.Xauthority            48 bytes     unknown
.xsession-errors       28.5 kB      plain text document
.xsession-errors.old   7.9 kB       backup file

The file .Xauthority contains a single line of meaningless (to me) letters and symbols.

The file .pulse-cookie contains characters like the following in gedit, most of them highlighted in red:

\EC\BD\C8\D5\ED\C2\EC\AF#\B6v\EE\83\F7\C2\C8vnr\EA 

.ICEauthority contains mostly readable phrases, almost all like these, and mostly highlighted in red:

unix/Pax:/tmp/.ICE-unix/1494\00#MIT-MAGIC-COOKIE-\00
local/Pax:@/tmp/.ICE-unix/1494\00#MIT-MAGIC-COOKIE-1\00

What is the difference between the paths shown in these 2 lines? And specifically, what does the @ symbol mean in this example?

I have read that these files have a security function, and that is why I am concerned. I am new to Ubuntu and don't know whether “unknown” file type is as ominous in Ubuntu as it is in Windows. My computer is not networked to any other, and was not attached to the Internet when these files were created.

Are these “unknown” files any indication of intrusion or hijack of my system? Anything I should worry about?

3
  • 1
    Those are standard config files, don't worry about them. Aug 28, 2012 at 4:44
  • 1
    If these are standard config files, why is their file type UNKNOWN? That screams there's something wrong with them!
    – nutrobion
    Aug 28, 2012 at 5:09
  • 4
    Because they are raw data rather than any standardised format, not intended to be opened by anything except the low-level parts of your system that created them. It might perhaps have made sense to have the file browser identify them as such, but since they are meant to be hidden anyway and there are many different types of specialised files I assume it was not considered a high priority.
    – chronitis
    Aug 28, 2012 at 7:46

3 Answers 3

5

Most of those files relate to your X server and are totally benign. Their contents is specific to the application which created them and generally you should not change them.

  • .ICEauthority is explained here.
  • .XAuthority is explained here.
  • .xsession-errors is an error log.
  • .pulse-cookie is a PulseAudio authentication cookie.
  • .profile contains commands which are executed when you log in.
    You may edit this file's contents.
2
  • I read the .ICEauthority file you referred me to. Since the file type is UNKNOWN, it is safe to assume that my PC may be communicating with an unknown server
    – nutrobion
    Aug 28, 2012 at 5:14
  • Apparently my X client is communicating with an UNKNOWN X client and an UNKNOWN Xserver. Do you have any idea how to find out which client & server I am communicating with?
    – nutrobion
    Aug 28, 2012 at 5:25
3

"unknown" in this case means that the file browser you are using doesn't know what format (image, text, etc) they are, and has nothing to do with security or security problems. A different file browser would likely show a different file type for those rather than "unknown".

All of the files you listed are normally created by legitimate programs on your computer, and your computer will not operate correctly without them.

If you are concerned about malicious programs on your computer, install and run something like chkrootkit: https://apps.ubuntu.com/cat/applications/chkrootkit

3

The file browser uses MIME type detection to identify a file and show its type. MIME type detection utilizes a series of heuristics, like looking at the file's content, maybe its extension, and so on, to try to intelligently determine the kind of data it contains. Files that show as "unknown" didn't contain any data that MIME type detection could identify. That doesn't mean they're suspect or invalid; it just means that the MIME type detection didn't know about those file types.

You can use the mimetype command on the command line to see how type detection is done for each file. Use the -D parameter to see the criteria it used to determine file type:

$ mimetype -D .ICEauthority 
> Data dirs are: /home/roadmr/.local/share, /usr/share/ubuntu, /usr/share/gnome, /usr/local/share, /usr/share
> Checking inode type
> Checking globs for basename '.ICEauthority'
> Checking for extension '.ICEauthority'
> Checking globs for basename '.iceauthority'
> Checking for extension '.iceauthority'
> File exists, trying default method
> First 10 bytes of the file contain control chars
.ICEauthority: application/octet-stream

Contrast this with a known file:

$ mimetype -D .xsession-errors
> Data dirs are: /home/roadmr/.local/share, /usr/share/ubuntu, /usr/share/gnome, /usr/local/share, /usr/share
> Checking inode type
> Checking globs for basename '.xsession-errors'
> File exists, trying default method
.xsession-errors: text/plain

From this you can see that files that are detected as "application/octet-stream" will be shown as "unknown".

1
  • By the way, if they seem so wrong and suspicious, one way you could help is by learning how to add new mime types and update the type detection database so these files are correctly identified; that way future users will benefit from this.
    – roadmr
    Aug 28, 2012 at 18:15

Not the answer you're looking for? Browse other questions tagged .