linux-kernel - Re: A syscall for changing birth time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250311170725.GE8837@mit.edu>
Date: Tue, 11 Mar 2025 13:07:25 -0400
From: "Theodore Ts'o" <tytso@....edu>
To: Al Viro <viro@...iv.linux.org.uk>
Cc: David Laight <david.laight.linux@...il.com>,
        "Artem S. Tashkinov" <aros@....com>, linux-ext4@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: A syscall for changing birth time

On Tue, Mar 11, 2025 at 04:56:35AM +0000, Al Viro wrote:
> On Tue, Mar 11, 2025 at 12:49:35AM -0400, Theodore Ts'o wrote:
> 
> > This really goes to my question of exactly how useful the file
> > creation time concept really is.  Perhaps that's why the developers at
> > the UC Berkley made ctime be "inode change time", I suspect when they
> > authored the BSD Fast File System 42 years ago.  Personally, while I
> > don't find "change time" to be all that useful --- I find "creation
> > time" an order of magnitude *more* useless.  :-)
> 
> The third timestamp had been introduced in v7 and it had been "change
> time" from the very beginning, with incremental backups as stated
> rationale in filesys(5).  "I'm sure that" from David means "I couldn't
> be arsed to check my WAG"...


I actually pulled down the V7 sources and there was a comment in
/usr/sys/h/ino.h which has a comment around the on-disk inode stating
"creation time" (see below).  These comments are also there up to
3BSD, and changed to "inode change time" in the BSD 4.2 sources,
probably coincident with the BSD Fast File System implementation.

So to be fair to David, I'm guessing this is what he saw.

I still maintain that "creation time" as a concept isn't terribly
useful, and that's probably *why* historical Unix systems have used
ctime as "change time" for decades.  Whether it's 42 years or 45 years
doesn't really change my point.

  		      		      	 - Ted

struct dinode
{
	unsigned short	di_mode;     	/* mode and type of file */
	short	di_nlink;    	/* number of links to file */
	short	di_uid;      	/* owner's user id */
	short	di_gid;      	/* owner's group id */
	off_t	di_size;     	/* number of bytes in file */
	char  	di_addr[40];	/* disk block addresses */
	time_t	di_atime;   	/* time last accessed */
	time_t	di_mtime;   	/* time last modified */
	time_t	di_ctime;   	/* time created */
};