Created attachment 1520275 [details]
The weird directory in Thunar

Description of problem:

abrt-applet creates "weird" directories in my home directory after (almost) each login.

Version-Release number of selected component (if applicable):

abrt-gui-2.11.1-2.fc29.x86_64

How reproducible:

Almost always - i.e. 75% on each login into XFCE

Steps to Reproduce:

1. abrt-gui recently updated to 2.11.1-2

    Upgrade  abrt-gui-2.11.1-2.fc29.x86_64                   @updates-testing
    Upgraded abrt-gui-2.11.0-1.fc29.x86_64                   @@System

2. After almost each login (XFCE), I see some new "weird" looking directories in my home directory.

In Thunar, they show as "0� (invalid encoding)"

In ls -l, they show as

drwxrwxr-x.  2 kman kman   4096 Jan 13 17:15 '0'$'\330'

The directory names do vary, but they're always weird names like this made of "invalid characters"

3. I used audit to track it down:

time->Sun Jan 13 17:15:22 2019
type=PROCTITLE msg=audit(1547388922.809:644): proctitle=616272742D6170706C6574002D2D676170706C69636174696F6E2D
73657276696365
type=PATH msg=audit(1547388922.809:644): item=1 name=30D8 inode=14041143 dev=103:01 mode=040775 ouid=1000 ogid
=1000 rdev=00:00 obj=unconfined_u:object_r:user_home_t:s0 nametype=CREATE cap_fp=0000000000000000 cap_fi=00000
00000000000 cap_fe=0 cap_fver=0
type=PATH msg=audit(1547388922.809:644): item=0 name="/home/kman" inode=13926401 dev=103:01 mode=040700 ouid=1
000 ogid=1000 rdev=00:00 obj=unconfined_u:object_r:user_home_dir_t:s0 nametype=PARENT cap_fp=0000000000000000 
cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=CWD msg=audit(1547388922.809:644): cwd="/home/kman"
type=SYSCALL msg=audit(1547388922.809:644): arch=c000003e syscall=83 success=yes exit=0 a0=55dd7eb29cf0 a1=1ff a2=ffffffffffffff80 a3=0 items=2 ppid=1693 pid=1823 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=4 comm="abrt-applet" exe="/usr/bin/abrt-applet" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="kman5"

Note the "name" in the audit - 30D8, believe this is binary

syscall=83 is mkdir

ausearch with "-i" - which is "show info as human readable" - gives:

type=PROCTITLE msg=audit(01/13/2019 17:15:22.809:644) : proctitle=abrt-applet --gapplication-service 
type=PATH msg=audit(01/13/2019 17:15:22.809:644) : item=1 name=0� inode=14041143 dev=103:01 mode=dir,775 ouid=kman ogid=kman rdev=00:00 obj=unconfined_u:object_r:user_home_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=PATH msg=audit(01/13/2019 17:15:22.809:644) : item=0 name=/home/kman inode=13926401 dev=103:01 mode=dir,700 ouid=kman ogid=kman rdev=00:00 obj=unconfined_u:object_r:user_home_dir_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 
type=CWD msg=audit(01/13/2019 17:15:22.809:644) : cwd=/home/kman 
type=SYSCALL msg=audit(01/13/2019 17:15:22.809:644) : arch=x86_64 syscall=mkdir success=yes exit=0 a0=0x55dd7eb29cf0 a1=0777 a2=0xffffffffffffff80 a3=0x0 items=2 ppid=1693 pid=1823 auid=kman uid=kman gid=kman euid=kman suid=kman fsuid=kman egid=kman sgid=kman fsgid=kman tty=(none) ses=4 comm=abrt-applet exe=/usr/bin/abrt-applet subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=kman5 

Note the "name=0�" above (same as it shows in Thunar)