linux-kernel - Re: [RFC 0/4] fs: provide per-filesystem options to disable fscrypt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y20/ynxvIqOyRbxK@mit.edu>
Date:   Thu, 10 Nov 2022 13:15:38 -0500
From:   "Theodore Ts'o" <tytso@....edu>
To:     Niels de Vos <ndevos@...hat.com>
Cc:     linux-fscrypt@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        linux-kernel@...r.kernel.org, Xiubo Li <xiubli@...hat.com>,
        Marcel Lauhoff <marcel.lauhoff@...e.com>
Subject: Re: [RFC 0/4] fs: provide per-filesystem options to disable fscrypt

On Thu, Nov 10, 2022 at 05:47:10PM +0100, Niels de Vos wrote:
> And, there actually are options like CONFIG_EXT4_FS_POSIX_ACL and
> CONFIG_EXT4_FS_SECURITY. Because these exist already, I did not expect
> too much concerns with proposing a CONFIG_EXT4_FS_ENCRYPTION...

Actually, I was thinking of getting rid of them, as we've already
gotten rid of EXT4_FS_POSIX_ACL....

> Thanks for adding some history about this. I understand that extra
> options are needed while creating/tuning the filesystems. Preventing
> users from setting the right options in a filesystem is not easy, even
> if tools from a distribution do not offer setting the options. Disks can
> be portable, or network-attached, and have options enabled that an other
> distributions kernel does not (want to) support.

Sure, but as I said, there are **tons** of file system features that
have not and/or still are not supported for distros, but for which we
don't have kernel config knobs.  This includes ext4's bigalloc and
inline data, btrfs's dedup and reflink support, xfs online fsck, etc.,
etc., etc.  Heck, ext4 is only supported up to a certain size by Red
Hat, and we don't have a Kernel config so that the kernel will
absolutely refuse to mount an ext4 file system larger than The
Officially Supported RHEL Capacity Limit for Ext4.  So what makes
fscrypt different from all of these other unsupported file system
features?

There are plenty of times when I've had to explain to customers why,
sure they could build their own kernels for RHEL 4 (back in the day
when I worked for Big Blue and had to talk to lots of enterprise
customers), but if they did, Red Hat support would refuse to give them
the time of day if they called asking for help.  We didn't set up use
digitally signed kernels with trusted boot so that a IBM server would
refuse to boot anything other than An Officially Signed RHEL
Kernel...

What makes fscrypt different that we think we need to enforce this
using technical means, other than a simple, "this feature is not
supported"?

						- Ted