| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <87hc183uhn.fsf@basilikum.skogtun.org> Date: Thu, 02 Apr 2009 00:00:04 +0200 From: Harald Arnesen <skogtun.harald@...il.com> To: david@...g.hm Cc: Bill Davidsen <davidsen@....com>, linux-kernel@...r.kernel.org Subject: Re: Linux 2.6.29 david@...g.hm writes: >> Understood that it's not deliberate just careless. The two behaviors >> which are reported are (a) updating a record in an existing file and >> having the entire file content vanish, and (b) finding some one >> else's old data in my file - a serious security issue. I haven't >> seen any report of the case where a process unlinks or truncates a >> file, the disk space gets reused, and then the systems fails before >> the metadata is updated, leaving the data written by some other >> process in the file where it can be read - another possible security >> issue. > > ext3 eliminates this security issue by writing the data before the > metadata. ext4 (and I thing XFS) eliminate this security issue by not > allocating the blocks until it goes to write the data out. I don't > know how other filesystems deal with this. I've been wondering about that during the last days. How abut JFS and data loss (files containing zeroes after a crash), as compared to ext3, ext4, ordered and writeback journal modes? Is is safe? -- Hilsen Harald. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists