linux-ext4 - Re: EXT4 partition changes every time it's mounted. (How to stop this?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 22 May 2011 21:39:04 -0700 (PDT)
From:	Lee Davis <l.davis37@...il.com>
To:	Theodore Tso <tytso@....EDU>
Cc:	"linux-ext4@...r.kernel.org" <linux-ext4@...r.kernel.org>
Subject: Re: EXT4 partition changes every time it's mounted. (How to stop this?)

Hi Ted,

I've checked again, and despite being mounted read-only, the filesystem is definitely changing every time I reboot.

The mount options are: ro,relatime,commit=0

I've taken three images of the filesystem (rebooting between each image), and with a bit of research I've managed to discover which fields in the superblock are being changed. They are: s_wtime and s_kbytes_written. 

Here's how they're being changed:

0x430 (s_wtime): 06C8D94D -> 68D0D94D -> B9D7D94D

0x578 (s_kbytes_written): 42C8000000000000 -> 45C8000000000000 -> 48C8000000000000

These two fields are the only things that are changing in the entire filesystem.

Any ideas on what might be causing this and/or how to disable it?

Much appreciated,
Lee

P.S. I just thought to test it after unmounting/re-mounting, and nothing was changed. So it appears to only get changed when I boot the system.

It's a fresh Ubuntu Natty installation, with GRUB on the MBR, an ext4 boot partition, and an encrypted ext4 root partition (which I set up through the installer). I can't think what might be writing to the boot partition.

----- Original Message -----
From: Theodore Tso <tytso@....EDU>
To: Lee Davis <l.davis37@...il.com>
Cc: "linux-ext4@...r.kernel.org" <linux-ext4@...r.kernel.org>
Sent: Sunday, 22 May 2011 9:47 PM
Subject: Re: EXT4 partition changes every time it's mounted. (How to stop this?)

On May 21, 2011, at 3:45 PM, Lee Davis wrote:

> I'm setting up a Linux system with full disk encryption. I've written a script (to run on every boot) which will verify that neither the MBR or /boot partition (ext4) has been modified.
> 
> Problem is that every time I boot up the system, my /boot partition hashes differently.
> 
> I'm guessing there is something behind the scenes which is changed/updated each time the filesystem is mounted? If so, can it be disabled?

Yes, there is a last mounted time in the superblock.   If you mount the file system read-only, then not only will that field not be changed, but you can guarantee that nothing else will change...

-- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html