linux-ext4 - Re: undelete still opened file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20081017153957.28a4dd67.taeuber@bbaw.de>
Date:	Fri, 17 Oct 2008 15:39:57 +0200
From:	Lars Täuber <taeuber@...w.de>
To:	Theodore Tso <tytso@....edu>
Cc:	Manish Katiyar <mkatiyar@...il.com>, linux-ext4@...r.kernel.org
Subject: Re: undelete still opened file

Hi Theodore,


Theodore Tso <tytso@....edu> schrieb:
> On Fri, Oct 17, 2008 at 02:33:11PM +0200, Lars Täuber wrote:
> > Is the space of the file on the underlying block device already
> > marked as free? Or does this happen after all processes have closed
> > all file descriptors pointing to the file?
> 
> No, the space on the file is not yet marked as free.  *However* for
> ext3 and ext4, the inode has been placed on the orphaned inode list,
> so that if the system crashes, part of the journal recovery process
> will at that point free the blocks.

not that it is a way I would go, but theoretically: I could provoke a crash and mount the ext3 filesystem as ext2 and restore the file?

> > I really want to undo the deletion. (get a link/name connected to
> > the root inode of the file again) Is there a way to do this?
> 
> Not currently using ext3/ext4, no.  There would have to be an entirely
> new system call or other userspace interface for something like this.

Is this planned?

But a solution should be independent of the real filesystem. Because the file is still somewhere in the ram and represented in linux vfs, isn't it?
It only needs to be copied/recreated on to a (different) filesystem somehow.

Regards
Lars
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html