linux-ext4 - Re: [PATCH] tune2fs: allow remove VERITY

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 23 Jun 2020 19:40:43 -0700
From:   Eric Biggers <ebiggers@...nel.org>
To:     Gwendal Grignou <gwendal@...omium.org>
Cc:     sarthakkukreti@...omium.org, tytso@....edu,
        linux-ext4@...r.kernel.org
Subject: Re: [PATCH] tune2fs: allow remove VERITY

On Tue, Jun 23, 2020 at 07:31:07PM -0700, Gwendal Grignou wrote:
> Allow verity flag to be removed from the susperblock:
> Tests:
> - check the signed file is readable by older kernel after flag
> is removed. EXT4_VERITY_FL replaces EXT4_EXT_MIGRATE that has been
> removed in 2009.
> - when a new kernel is reinstalled, check reenabling verity flag
> allow signature to be verified (fsverity measure ...).
> 
> Signed-off-by: Gwendal Grignou <gwendal@...omium.org>
> ---
>  misc/tune2fs.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/misc/tune2fs.c b/misc/tune2fs.c
> index 314cc0d0..724b8014 100644
> --- a/misc/tune2fs.c
> +++ b/misc/tune2fs.c
> @@ -198,7 +198,8 @@ static __u32 clear_ok_features[3] = {
>  		EXT4_FEATURE_RO_COMPAT_QUOTA |
>  		EXT4_FEATURE_RO_COMPAT_PROJECT |
>  		EXT4_FEATURE_RO_COMPAT_METADATA_CSUM |
> -		EXT4_FEATURE_RO_COMPAT_READONLY
> +		EXT4_FEATURE_RO_COMPAT_READONLY |
> +		EXT4_FEATURE_RO_COMPAT_VERITY
>  };
>  

tune2fs doesn't allow removing features like encrypt, casefold, verity, extents,
and ea_inode because it doesn't know whether there are any inodes on the
filesystem that are using these features.  These features can't be removed if
there are any inodes using them.

There was recently a suggestion to make tune2fs scan the inode table to
determine whether it is safe to remove these flags; see
https://lkml.kernel.org/linux-ext4/C0761869-5FCD-4CC7-9635-96C18744A0F8@dilger.ca
and
https://lkml.kernel.org/linux-ext4/20200407053213.GC102437@sol.localdomain

I think you'd need to implement that in order for clearing verity to be safe.

Note that misc/tune2fs.8.in would also need to be updated to remove the sentence
that says that clearing the verity feature is unsuppported.

- Eric