linux-kernel - Re: [PATCH v4] ceph: mark directory as non-complete complete after loading key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 29 Nov 2022 15:32:41 +0100
From:   Ilya Dryomov <idryomov@...il.com>
To:     Xiubo Li <xiubli@...hat.com>
Cc:     Luís Henriques <lhenriques@...e.de>,
        Jeff Layton <jlayton@...nel.org>, ceph-devel@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4] ceph: mark directory as non-complete complete after
 loading key

On Tue, Nov 29, 2022 at 3:15 PM Xiubo Li <xiubli@...hat.com> wrote:
>
>
> On 29/11/2022 18:39, Luís Henriques wrote:
> > When setting a directory's crypt context, ceph_dir_clear_complete() needs to
> > be called otherwise if it was complete before, any existing (old) dentry will
> > still be valid.
> >
> > This patch adds a wrapper around __fscrypt_prepare_readdir() which will
> > ensure a directory is marked as non-complete if key status changes.
> >
> > Signed-off-by: Luís Henriques <lhenriques@...e.de>
> > ---
> > Hi Xiubo,
> >
> > Here's a rebase of this patch.  I did some testing but since this branch
> > doesn't really have full fscrypt support, I couldn't even reproduce the
> > bug.  So, my testing was limited.
>
> I'm planing not to update the wip-fscrypt branch any more, except the IO
> path related fixes, which may introduce potential bugs each time as before.
>
> Since the qa tests PR has finished and the tests have passed, so we are
> planing to merge the first none IO part, around 27 patches. And then
> pull the reset patches from wip-fscrypt branch.

I'm not sure if merging metadata and I/O path patches separately
makes sense.  What would a user do with just filename encryption?

Once fscrypt test suite is merged, I think we should let it bake
for for a few weeks and then merge the whole thing together.

Thanks,

                Ilya