linux-ext4 - Re: About read-only feature EXT4_FEATURE_RO_COMPAT_SHARED

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 1 Feb 2020 19:16:27 -0700
From:   Andreas Dilger <adilger@...ger.ca>
To:     Qu Wenruo <quwenruo.btrfs@....com>
Cc:     linux-ext4@...r.kernel.org,
        Linux FS Devel <linux-fsdevel@...r.kernel.org>
Subject: Re: About read-only feature EXT4_FEATURE_RO_COMPAT_SHARED_BLOCKS

On Feb 1, 2020, at 7:02 PM, Qu Wenruo <quwenruo.btrfs@....com> wrote:
> 
> Hi ext4 guys,
> 
> Recently I found an image from android (vendor.img) has this RO feature
> set, but kernel doesn't support it, thus no easy way to modify it.
> (Although I can just modify the underlying block for my purpose, it's
> just one line change, I still want a more elegant way).
> 
> Thus it can only be mounted RO. So far so good, as from its name, it's
> kinda of deduped (BTW, both XFS and Btrfs supports RW mount for
> reflinked/deduped fs).
> 
> But the problem is, how to create such image?
> 
> Man page of mke2fs has no mention of such thing at all, and obviously
> for whoever comes up with such "brilliant" way to block users from
> modifying things, the "-E unshare_blocks" will just make the image too
> large for the device.
> 
> Or we must go the Android rabbit hole to find an exotic tool to modify
> even one line of a config file?

I believe that this feature was only implemented inside Google.

However, if you want to make changes to some files in this filesystem
there should be a number of ways to do it:
- use "dd" to dump file block(s) from image, edit them, then write back.
  use "debugfs -c -R 'stat /path/to/file' vendor.img" for block addresses
- use debugfs to clear the flag, mount the filesystem normally, then
  overwrite the file *in place* (using "dd" or similar) so that the
  blocks for the shared file are not reallocated due to unlink, write
- make a simple patch for the kernel to "support" this feature, then
  mount it and modify the file in a similar manner

Cheers, Andreas






Download attachment "signature.asc" of type "application/pgp-signature" (874 bytes)