linux-ext4 - Re: undelete still opened file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20081017161432.GB8755@mit.edu>
Date:	Fri, 17 Oct 2008 12:14:32 -0400
From:	Theodore Tso <tytso@....edu>
To:	Lars Täuber <taeuber@...w.de>
Cc:	Manish Katiyar <mkatiyar@...il.com>, linux-ext4@...r.kernel.org
Subject: Re: undelete still opened file

On Fri, Oct 17, 2008 at 03:39:57PM +0200, Lars Täuber wrote:
> 
> not that it is a way I would go, but theoretically: I could provoke
> a crash and mount the ext3 filesystem as ext2 and restore the file?
> 

Unless you then manually modify the orphan list to remove the inode
from the orphan list, the next time you mount the filesystem as ext3
the blocks will be released and the filesystem will be corrupted.
Also, if you provoke a crash, the filesystem will be marked as "needs
recovery" and ext2 will refuse to mount the filesystem.

The much simpler way would be to kill -STOP the process that owns the
file, copy it via "cat /proc/$pid/fd/$fd > rescue-file". and then kill
-9 the process if you don't want it to make any further changes.

> > Not currently using ext3/ext4, no.  There would have to be an entirely
> > new system call or other userspace interface for something like this.
> 
> Is this planned?

No, this is not planned.   "rm is forever". 

> But a solution should be independent of the real filesystem. Because
> the file is still somewhere in the ram and represented in linux vfs,
> isn't it?  It only needs to be copied/recreated on to a (different)
> filesystem somehow.

No, it's not necessarily in RAM.  It's on disk, in the filesystem, but
marked in such a way that if the system crashes or when the file
descriptor is closed, the inode and its contents are marked as freed
for allocation.

							- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html