lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAHk-=wgdzWgoPSuHeVcqmGE1hB3Gan72r2_AhtC14e60=z45yg@mail.gmail.com> Date: Fri, 21 Dec 2018 11:13:07 -0800 From: Linus Torvalds <torvalds@...ux-foundation.org> To: "Theodore Y. Ts'o" <tytso@....edu>, Christoph Hellwig <hch@...radead.org>, Dave Chinner <david@...morbit.com>, "Darrick J. Wong" <darrick.wong@...cle.com>, Eric Biggers <ebiggers@...nel.org>, linux-fscrypt@...r.kernel.org, linux-fsdevel <linux-fsdevel@...r.kernel.org>, linux-ext4@...r.kernel.org, linux-f2fs-devel@...ts.sourceforge.net, linux-integrity@...r.kernel.org, Linux List Kernel Mailing <linux-kernel@...r.kernel.org>, Jaegeuk Kim <jaegeuk@...nel.org>, Victor Hsieh <victorhsieh@...gle.com>, Chandan Rajendra <chandan@...ux.vnet.ibm.com>, Linus Torvalds <torvalds@...ux-foundation.org> Subject: Re: [PATCH v2 01/12] fs-verity: add a documentation file On Fri, Dec 21, 2018 at 7:47 AM Theodore Y. Ts'o <tytso@....edu> wrote: > > Linus --- we're going round and round, and I don't think this is > really a technical dispute at this point, but rather an aesthetics > one. Grr. So honestly, I personally *like* the model of "the file contains its own validation data" model. I think that's the right model, so that you can then basically just do "enable verification on this file, and verify that the root hash is this". So that part I like. I think the people who argue for "let's have a separate interface that writes the merkle tree data" are completely wrong. HOWEVER. I do agree that your particular model is pretty damn broken in lots of ways. Why is it filesystem specific? If the whole point is that the file itself has its own verification data (which I like), then I don't see why this is then documented as some filesystem-specific layout model. That's complete and utter garbage. In other words: either the model is that the file *itself* contains its own merkle tree that validates the file, or it isn't. You can't have it two ways. No silly "layout changes when you apply the hash" garbage. That's just crazy talk and invalidates the whole model. And honestly, I still think that it's very odd to add the merge data to the end, when the filesystem already supports xattrs. It would have made much more sense to just make one xattr contain the merkle tree validation data. So why is this sold as some unholy mess of "filesystem-specific" and "generic"? That part just annoys the hell out of me. Why isn't this sold as an *actual* generic model, where you just say "append the merkle tree to the file, then enable verity testing of the end result and validate the top-level hash". That kind of thing could be done with absolutely _zero_ per-filesystem code, and made 100% generic, and we'd just verify the merge data in readpages(). So what's the excuse for doing the crazy odd "let's just support one single filesystem" model? Linus
Powered by blists - more mailing lists