Hey all, recently I was doing some work on the machine where I host my plex and audiobookshelf servers and I noticed that there were 3 new devices listed in the disk manager.
All 3 of the new devices have a description along the lines of “78MB Loop Device” and lists a backing file at location /var/lib/snapd/snaps/snapd_22291.snap (not exactly but they’re all similar to this). They show as unmounted and I’m not really sure what this is.
Additionally when I try to use libation to pull my latest audible books down it says it can’t read my local file location folder.
I recently saw the post about the plex vulnerability (which is part of why i was doing work on it, to make sure that my auto update was working) when I noticed this and it got me worried.
Are these new devices that showed up indicative that a malicious user has accessed my system through the internet and has setup a crypto miner to run in the background on my server or is it more likely that a disk is failing and this is the first sign?
Also before anyone feels the need to say it, I know that plex is not ideal and jellyfin is better, but I have remote users that I cannot talk through troubleshooting to get jellyfin when I can tell them to just install plex on their end.
Any help would be greatly appreciated
Loop devices are just files mapped as block devices. Snaps cordon off an area on disk for install and config, you should probably see more than one per app if you updated, that’s how snaps can be reverted to previous versions. You can set how many versions snaps keep per app.
That makes sense, are they intended to persist indefinitely, only while the subject application is running, or do they go away after a period of time? Thanks for your help!
I have limited exposure to snaps, but from my experience, the oldest eventually gets overwritten by newer ones.