On Mon, Jul 11, 2011 at 2:13 AM, Ted Ts'o [off-list ref] wrote:

On Fri, Jul 08, 2011 at 09:29:16AM +0300, Amir Goldstein wrote:

quoted

Well, that really depends of the precise definition of "secure delete".
If you agree with the "100% secure" interpretation, then your current patch
is "almost" correct.
I can see 2 things that are missing:
1. ext4_unlink() will have to invoke ext4_truncate(0) directly just
like truncate system call does.
This is to prevent an attacker from keeping the protected file open
and preventing freeing
of it's data when the file is removed from the name space.

Um, no.  This breaks Unix semantics, which is going to cause any kind
of headaches, especially if someone sets the secure delete flag on a
directory, and then a hapless application creates a file in said
directory expecting standard Posix semantics.

If the attacker has a handle on the file, he can just simply copy out
the data to another file; if you're worried about someone who manages
to open the file just 1 millisecond before you do the delete (as
opposed 100 milliseconds, when he would have copy out the file), I
don't think it's worth it.

Maybe it's an attacker and maybe the user just doesn't know if an application
has a loose handle for this file.
In both cases, "truncate -s 0 mysecret && rm mysecret" would be more
full proof than "rm mysecret".
I do agree it makes more sense to do it with userspace tools in the first place.

quoted

2. ext4_truncate() currently changes i_disksize first (and adds inode
to orphan list)
and then frees the blocks. for 100% secure delete, you cannot change i_disksize
before zeroing the blocks, so it has to be:
- zeroout range
- change i_disksize and add to orphan list
- free blocks

What are you worried about here?

I am worried (but it doesn't keep me up at night) from orphan cleanup
after crash in the
middle of secure truncate.
Sure, if you boot with the same kernel, orphan cleanup will securely
truncate the rest
of the file, but another kernel may also non-securely truncate the
file and the accountant
will not know what hit him on judgement day.

Anyway, I don't care much for security nor for accountants, so no need
to convince me
one way or the other.

Amir.
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html