lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:	Thu, 23 Feb 2012 21:27:50 +0000
From:	Neil Clarkson <>
Subject: ext4 superblock last write time clearly isnt the last write time

Isn't the s_wtime field of the ext4 superblock supposed to show the
time, in seconds since the epoch, of the last write to the file
system? All the public domain info I found seems to indicate so, as
does this excerpt of code from 'static int ext4_commit_super(struct
super_block *sb, int sync)'

	 * If the file system is mounted read-only, don't update the
	 * superblock write time.  This avoids updating the superblock
	 * write time when we are mounting the root file system
	 * read/only but we need to replay the journal; at that point,
	 * for people who are east of GMT and who make their clock
	 * tick in localtime for Windows bug-for-bug compatibility,
	 * the clock is set in the future, and this will cause e2fsck
	 * to complain and force a full file system check.
	if (!(sb->s_flags & MS_RDONLY))
		es->s_wtime = cpu_to_le32(get_seconds());

Yet I noticed, on the 3 systems available to me, that it isn't
anything of the sort. Using dumpe2fs -h to show the timestamp fields
in the superblock, one seems be set at a half hour post file system
creation, the others clearly mirror the last mount time. None of them
are showing the time of the last write. None of them are mounted read

Linux Wallace 3.0.0-16-generic #28-Ubuntu SMP Fri Jan 27 17:44:39 UTC
2012 x86_64 x86_64 x86_64 GNU/Linux (Ubuntu 11.10)

Filesystem created:       Wed Nov 23 13:42:18 2011
Last mount time:          Tue Feb 21 09:07:54 2012
Last write time:          Wed Nov 23 14:12:57 2011

Linux VM-OpenSUSE2 #1 SMP PREEMPT 2011-02-21
10:34:10 +0100 x86_64 x86_64 x86_64 GNU/Linux (Open SUSE 11.4)

Filesystem created:       Fri Sep 23 18:04:27 2011
Last mount time:          Fri Jan 27 09:34:55 2012
Last write time:          Fri Jan 27 09:34:55 2012

Linux fedoraVM #1 SMP Mon Oct 18 23:56:17 UTC
2010 i686 i686 i386 GNU/Linux (Fedora 14)

Filesystem created:       Wed Nov  3 07:24:17 2010
Last mount time:          Fri Feb  3 13:04:41 2012
Last write time:          Fri Feb  3 13:04:41 2012

Clearly I'm missing something? Anyone know what? I've not found any
hints so far.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

Powered by blists - more mailing lists