3

Apparmor shows various programs need read access to files with names like "orcexec.3JIkjU84". it's always orcexec.* which allows for them to be read.

What is the purpose of these files?

Improve this question
1
  • Yikes! Thank you. So it seems I should continue blocking their creation, if I really want to lock things down. Pidgin, Pulseaudio and Firefox, off the top of my head, make these files in /home and certain spots in var and tmp. All processes I've blocked orcexec files still in work fine.
    – user188855
    Aug 31, 2013 at 0:30

1 Answer 1

Reset to default
2

These files contain JIT compiled code. They are created and immediately unlinked even before execution has finished. The component responsible for their generation is orclib, see http://code.entropywave.com/orc/ All kind of tools get confused by these files, because more typically executable code never changes, and in the worst case changing code might be a sign of malware.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .