linux-kernel - Re: completely hide parts of the partition table from Windows?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 23 Aug 2009 00:59:01 +0200
From:	Mikael Pettersson <mikpe@...uu.se>
To:	Mikael Pettersson <mikpe@...uu.se>
Cc:	"Andries E. Brouwer" <Andries.Brouwer@....nl>,
	linux-kernel@...r.kernel.org
Subject: Re: completely hide parts of the partition table from Windows?

Mikael Pettersson writes:
 > Andries E. Brouwer writes:
 >  > On Tue, Aug 18, 2009 at 11:22:30PM +0200, Mikael Pettersson wrote:
 >  > 
 >  > > So what I'm looking for is some sub-partition table format with the
 >  > > following two properties:
 >  > > 1. resides in an msdos partition entry of a type that Windows does
 >  > >    not inspect (for whatever extended partitions or Apple/BSD/Sun
 >  > >    stuff that Windows may have been taught to recognize)
 >  > > 2. the locations and sizes of the sub-partitions are NOT limited by
 >  > >    the parent msdos partition entry
 >  > 
 >  > The reason I added type 85 = LINUX_EXTENDED_PARTITION
 >  > was precisely your concern: it should be something
 >  > that DOS/Windows doesnt know about.
 >  > 
 >  > > I've looked at the code in fs/partitions/msdos.c, and it seems that
 >  > > most of the extended/BSD/Sun formats don't give me property #2 above.
 >  > 
 >  > The standard description of extended partitions says that the size field
 >  > of the parent extended partition descriptor is irrelevant, only the
 >  > starting sector matters.
 >  > 
 >  > If you look at the parse_extended() code in msdos.c you'll see
 >  > that it does not use its parameter first_size.
 >  > (Except in a certain case that you will not be in.)
 > 
 > Right. I misread the "process the data partitions" part to imply
 > that the limits were enforced for all four entries, not just the
 > last two usually-junk entries. Thanks for clarifiying that.
 > 
 >  > Make a table that has a Linux extended partition (type 85)
 >  > that is short enough not to cause Windows to worry. Have logical
 >  > partitions inside of any size and location you desire.
 > 
 > I have created extended partitions with non-default type
 > (though not 85). I'll see if I can convince fdisk or parted to
 > create one with entries exceeding the parent's limits.

The problem here is that both fdisk and parted refuse to let me
create a logical partition that exceeds the boundaries of the
enclosing extended partition entry. So for this approach I'd have
to find another Linux partitioning tool, or hack e.g. fdisk to
bypass its safety checks (which do make sense for most use cases,
just not for mine).
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/