linux-kernel - Re: A syscall for changing birth time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250311200119.4802d896@pumpkin>
Date: Tue, 11 Mar 2025 20:01:19 +0000
From: David Laight <david.laight.linux@...il.com>
To: "Theodore Ts'o" <tytso@....edu>
Cc: Al Viro <viro@...iv.linux.org.uk>, "Artem S. Tashkinov" <aros@....com>,
 linux-ext4@...r.kernel.org, Linux Kernel Mailing List
 <linux-kernel@...r.kernel.org>
Subject: Re: A syscall for changing birth time

On Tue, 11 Mar 2025 13:07:25 -0400
"Theodore Ts'o" <tytso@....edu> wrote:

> On Tue, Mar 11, 2025 at 04:56:35AM +0000, Al Viro wrote:
> > On Tue, Mar 11, 2025 at 12:49:35AM -0400, Theodore Ts'o wrote:
> >   
> > > This really goes to my question of exactly how useful the file
> > > creation time concept really is.  Perhaps that's why the developers at
> > > the UC Berkley made ctime be "inode change time", I suspect when they
> > > authored the BSD Fast File System 42 years ago.  Personally, while I
> > > don't find "change time" to be all that useful --- I find "creation
> > > time" an order of magnitude *more* useless.  :-)  
> > 
> > The third timestamp had been introduced in v7 and it had been "change
> > time" from the very beginning, with incremental backups as stated
> > rationale in filesys(5).  "I'm sure that" from David means "I couldn't
> > be arsed to check my WAG"...  
> 
> 
> I actually pulled down the V7 sources and there was a comment in
> /usr/sys/h/ino.h which has a comment around the on-disk inode stating
> "creation time" (see below).  These comments are also there up to
> 3BSD, and changed to "inode change time" in the BSD 4.2 sources,
> probably coincident with the BSD Fast File System implementation.
> 
> So to be fair to David, I'm guessing this is what he saw.

Quite likely - it was a long time ago and I didn't take an 'offsite
backup' of the sources (and I definitely have nothing that will read
the system disk from an old 68010 box).
I didn't use Unix until the mid 80s - and I think that was SVR2 rather
than anything Berkeley. Most of the systems were SVR4 - around the time
of the initial collaboration between AT&T and Sun to get SMP working
(which, IIRC, pulled some BSD code into SVR4).

> I still maintain that "creation time" as a concept isn't terribly
> useful, and that's probably *why* historical Unix systems have used
> ctime as "change time" for decades.  Whether it's 42 years or 45 years
> doesn't really change my point.

I do have half a brain cell that remembers it not quite being 'file
create' time - probably just changes to di_mode, di_uid or di_gid.

Anyway it is all old history.

	David

> 
>   		      		      	 - Ted
> 
> struct dinode
> {
> 	unsigned short	di_mode;     	/* mode and type of file */
> 	short	di_nlink;    	/* number of links to file */
> 	short	di_uid;      	/* owner's user id */
> 	short	di_gid;      	/* owner's group id */
> 	off_t	di_size;     	/* number of bytes in file */
> 	char  	di_addr[40];	/* disk block addresses */
> 	time_t	di_atime;   	/* time last accessed */
> 	time_t	di_mtime;   	/* time last modified */
> 	time_t	di_ctime;   	/* time created */
> };
>