linux-ext4 - [Bug 214665] security bug:using "truncate" bypass disk quotas limit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 11 Oct 2021 14:24:50 +0000
From:   bugzilla-daemon@...zilla.kernel.org
To:     linux-ext4@...r.kernel.org
Subject: [Bug 214665] security bug:using "truncate" bypass disk quotas limit

https://bugzilla.kernel.org/show_bug.cgi?id=214665

Lukas Czerner (lczerner@...hat.com) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |lczerner@...hat.com

--- Comment #3 from Lukas Czerner (lczerner@...hat.com) ---
Quotas help to control the amount of space and number of inodes used. If the
sparse file (created by truncate, or seek/write, or any other method available)
does not actually consume the fs space, then it simply can't be accounted for
by quota. So as Ted already said it is working as expected.

Back to your scenario. Quota has nothing to say about how the files are
manipulated so if the program copying/decompressing or otherwise manipulating
the sparse file decides to actually write the zeros and thus allocate the
space, so be it. That's hardly a bug in quota or file system itself.

If your expectation is that while manipulating the sparse file, the file will
remain sparse, you should make sure that the tools you're using will actually
do what you want. Note that tar does have --sparse options which, if I
understand your example correctly, should work as you expect.

Some basic information about sparse can be found here files
https://en.wikipedia.org/wiki/Sparse_file

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.