From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from outpost1.zedat.fu-berlin.de ([130.133.4.66]:46162 "EHLO outpost1.zedat.fu-berlin.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750872AbeEFIwO (ORCPT ); Sun, 6 May 2018 04:52:14 -0400 Subject: Re: moving affs + RDB partition support to staging? To: jdow , Geert Uytterhoeven , Martin Steigerwald Cc: Matthew Wilcox , David Sterba , Linux FS Devel , Linux Kernel Mailing List , Jens Axboe , linux-m68k References: <20180425154602.GA8546@bombadil.infradead.org> <20180425203029.GQ21272@twin.jikos.cz> <20180426025717.GA32430@bombadil.infradead.org> <1613268.lKBQxPXt8J@merkaba> <7a997bb7-7f1c-e8b4-667c-3993f1d82e7c@earthlink.net> From: John Paul Adrian Glaubitz Message-ID: Date: Sun, 6 May 2018 10:52:10 +0200 MIME-Version: 1.0 In-Reply-To: <7a997bb7-7f1c-e8b4-667c-3993f1d82e7c@earthlink.net> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On 04/27/2018 03:26 AM, jdow wrote: > And before I forget there are two features of the RDBs that I heartily recommend never implementing on Linux. They were good ideas at the time; but, times > changed. The RDBs are capable of storing a filesystem driver and some drive init code for the plugin disk driver card. That is giving malware authors entirely > goo easy a shot at owning a machine. Martin S., I would strongly suggest that going forward those two capabilities be removed from the RDB readers in AmigaOS > as well as Linux OS. I assume removing the feature for AmigaOS isn't really possible since we don't have the source code for that, do we? Also, if I remember correctly, Mac partitions can store filesystem drivers as well and its actually a feature being used in MacOS. parted received a patch some time ago to fix the correct handling for storing the filesystem driver in the partition table. I would be generally against removing these features as I don't think the security risk is relevant for the majority of users. The Amiga is a hobbyist machine these days and AmigaOS has certainly way more on than way to be compromised through vulnerabilities. Adrian -- .''`. John Paul Adrian Glaubitz : :' : Debian Developer - glaubitz@debian.org `. `' Freie Universitaet Berlin - glaubitz@physik.fu-berlin.de `- GPG: 62FF 8A75 84E0 2956 9546 0006 7426 3B37 F5B5 F913