linux-kernel - Re: Linux & FAT32 label

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 16 Oct 2017 03:12:37 +0200
From:   Andreas Bombe <aeb@...ian.org>
To:     Pali Rohár <pali.rohar@...il.com>
Cc:     Pavel Machek <pavel@....cz>, Karel Zak <kzak@...hat.com>,
        util-linux@...r.kernel.org, linux-kernel@...r.kernel.org,
        Andrius Štikonas <andrius@...konas.eu>,
        Curtis Gedak <gedakc@...il.com>
Subject: Re: Linux & FAT32 label

On Mon, Oct 16, 2017 at 12:04:50AM +0200, Pali Rohár wrote:
> On Sunday 15 October 2017 08:59:01 Pavel Machek wrote:
> > Hi!
> > 
> > > Based on results I would propose following unification:
> > > 
> > ...
> > > 4. Prefer label from the root directory. If there is none entry (means
> > >    there is also no erased entry), then read label from root sector.
> > > 
> > >    --> Reason: Windows XP and mlabel ignores what is written in boot
> > >        sector. Windows XP even do not update boot sector, so label
> > >        stored in boot sector is incorrect after any change done by
> > >        Windows XP.
> > > 
> > >        But due to compatibility with older dosfslabel, which stores
> > >        label only to boot sector, there is need for some fallback. Due
> > >        to point 1. the best seems to be to process also erased label in
> > >        root directory (marked with leading 0xE5) and fallback to boot
> > >        sector only in case label in root directory is missing.
> > > 
> > > What do you think about it?
> > 
> > 4. seems dangerous. Assume we have "OLD" in boot sector and "0xe5-EW" in the directory
> > entry. The label will change from <none> to "OLD" when the directory entry is reused by
> > "FOO.TXT", right? That seems surprising / dangerous.
> 
> Hm... that is a good question what happen (I do not know). I think that
> current situation when Windows XP show different label as Linux is also
> _surprising_.
> 
> Do you have a better idea what to do and how to handle this situation?

I have been saying this, a deleted directory entry has no valid contents
and its existence should not be considered meaningful. A Windows
formatted FAT filesystem without label will have no root directory label
entry and if an existing label is deleted, that deleted entry can be
overwritten at any time.

"Ignoring the presence of boot sector labels" is the only thing I see
for practical Windows compatibility.