From: Dave Chinner <email@example.com> To: David Howells <firstname.lastname@example.org> Cc: email@example.com, firstname.lastname@example.org, email@example.com, firstname.lastname@example.org, email@example.com, firstname.lastname@example.org Subject: Re: [PATCH 1/6] statx: Add a system call to make enhanced file info available Date: Thu, 5 May 2016 08:56:02 +1000 [thread overview] Message-ID: <20160504225601.GZ26977@dastard> (raw) In-Reply-To: <email@example.com> On Fri, Apr 29, 2016 at 01:57:43PM +0100, David Howells wrote: > (4) File creation time (st_btime*), data version (st_version), inode > generation number (st_gen). > > These will be returned if available whether the caller asked for them or > not. The corresponding bits in st_mask will be set or cleared as > appropriate to indicate a valid value. IMO, exposing the inode generation number to anyone is a potential security problem because they are used in file handles. Most file handles provided by filesystems are simply an encoding of the inode number + generation number, plus maybe the ino+gen of the parent dir if the NFS server is configured to do this. This makes it trivial for an attacker to guess what the likely generation numbers are going to be for inode numbers surrounding any given inode, hence greatly reducing the search space for guessing valid file handles. We've known this to be a problem for a long time - file handles are not cryptographically secure, so exposing information like this by default make guessing handles successfully almost trivial for many filesystems. In the latest XFS filesystem format, we randomise the generation value during every inode allocation to make it hard to guess the handle of adjacent inodes from an existing ino+gen pair, or even from life time to life time of the same inode. We don't use a secure random number generator (prandom_u32()) so it's still possible to guess with enough trial and observation. However, it makes it several orders of magnitude harder to guess and requires knowledge of inode allocation order to guess correctly once the random number sequence has been deduced and so makes brute force the only real option for guessing a valid handle for an inode. However, this is definitely a problem for the older format where each cluster of inodes was initialised with the same seed at cluster allocation time and the generation number was simply incremented for each life time. Most filesystems use a similar method for seeding and incrementing generation numbers, so once the generation numbers are exposed it makes handles trivial to calculate successfully. > If the caller didn't ask for them, then they may be approximated. For > example, NFS won't waste any time updating them from the server, unless > as a byproduct of updating something requested. I would suggest that exposing them from the NFS server is something we most definitely don't want to do because they are the only thing that keeps remote users from guessing filehandles with ease.... Cheers, Dave. -- Dave Chinner firstname.lastname@example.org
next prev parent reply other threads:[~2016-05-04 22:56 UTC|newest] Thread overview: 76+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-04-29 12:57 [RFC][PATCH 0/6] Enhanced file stat system call David Howells 2016-04-29 12:57 ` [PATCH 1/6] statx: Add a system call to make enhanced file info available David Howells 2016-05-02 22:46 ` Andreas Dilger 2016-05-02 22:46 ` Andreas Dilger 2016-05-03 15:53 ` David Howells 2016-05-04 22:56 ` Dave Chinner [this message] 2016-05-05 0:09 ` NeilBrown 2016-05-05 0:09 ` NeilBrown 2016-05-05 19:48 ` Jeff Layton 2016-05-06 18:07 ` J. Bruce Fields 2016-05-06 18:07 ` J. Bruce Fields 2016-05-05 20:04 ` David Howells 2016-05-05 20:04 ` David Howells 2016-05-06 1:39 ` Dave Chinner 2016-05-06 1:39 ` Dave Chinner 2016-05-06 1:39 ` Dave Chinner 2016-05-06 18:29 ` J. Bruce Fields 2016-05-09 1:45 ` Dave Chinner 2016-05-09 2:46 ` J. Bruce Fields 2016-05-04 23:56 ` NeilBrown 2016-05-08 8:35 ` Christoph Hellwig 2016-05-08 8:35 ` Christoph Hellwig 2016-05-09 12:02 ` Jeff Layton 2016-05-09 12:02 ` Jeff Layton 2016-05-10 7:00 ` Christoph Hellwig 2016-05-10 7:00 ` Christoph Hellwig 2016-05-10 13:21 ` Jeff Layton 2016-05-10 13:21 ` Jeff Layton 2016-05-09 12:57 ` David Howells 2016-05-09 12:57 ` David Howells 2016-05-09 13:23 ` Trond Myklebust 2016-05-09 13:23 ` Trond Myklebust 2016-05-09 13:23 ` Trond Myklebust 2016-05-10 7:04 ` Christoph Hellwig 2016-05-10 8:25 ` David Howells 2016-05-12 9:11 ` Christoph Hellwig 2016-05-13 15:28 ` Arnd Bergmann 2016-05-13 15:28 ` Arnd Bergmann 2016-05-23 8:22 ` Christoph Hellwig 2016-05-23 9:33 ` David Howells 2016-05-18 10:55 ` David Howells 2016-05-09 13:00 ` David Howells 2016-05-09 13:00 ` David Howells 2016-05-09 13:38 ` David Howells 2016-05-10 7:08 ` Christoph Hellwig 2016-05-10 8:43 ` David Howells 2016-05-12 9:12 ` Christoph Hellwig 2016-05-09 13:40 ` David Howells 2016-04-29 12:57 ` [PATCH 2/6] statx: AFS: Return enhanced file attributes David Howells 2016-04-29 12:57 ` [PATCH 3/6] statx: Ext4: " David Howells 2016-05-02 22:48 ` Andreas Dilger 2016-05-03 20:24 ` David Howells 2016-05-03 20:24 ` David Howells 2016-05-08 8:38 ` Christoph Hellwig 2016-05-08 8:38 ` Christoph Hellwig 2016-04-29 12:58 ` [PATCH 4/6] statx: NFS: " David Howells 2016-05-02 22:48 ` Andreas Dilger 2016-04-29 12:58 ` [PATCH 5/6] statx: Make windows attributes available for CIFS, NTFS and FAT to use David Howells 2016-05-02 22:52 ` Andreas Dilger 2016-10-03 21:03 ` Steve French 2016-10-03 21:03 ` Steve French 2016-05-03 20:23 ` David Howells 2016-05-08 8:39 ` Christoph Hellwig 2016-05-08 8:39 ` Christoph Hellwig 2016-04-29 12:58 ` [PATCH 6/6] statx: CIFS: Return enhanced attributes David Howells 2016-04-30 21:05 ` [RFC][PATCH 0/6] Enhanced file stat system call Jeff Layton 2016-04-30 21:05 ` Jeff Layton 2016-05-04 13:46 ` Arnd Bergmann 2016-05-04 13:46 ` Arnd Bergmann 2016-05-05 22:54 ` Steve French 2016-05-06 2:00 ` Steve French 2016-05-09 13:09 ` Arnd Bergmann 2016-05-09 13:09 ` Arnd Bergmann 2016-05-13 14:28 ` Richard Sharpe 2016-05-13 14:28 ` Richard Sharpe 2016-05-13 15:08 ` Arnd Bergmann
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20160504225601.GZ26977@dastard \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --subject='Re: [PATCH 1/6] statx: Add a system call to make enhanced file info available' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.