* EXT4 partition changes every time it's mounted. (How to stop this?)
@ 2011-05-21 19:45 Lee Davis
2011-05-22 11:47 ` Theodore Tso
0 siblings, 1 reply; 4+ messages in thread
From: Lee Davis @ 2011-05-21 19:45 UTC (permalink / raw)
To: linux-ext4
Hi folks,
I'm setting up a Linux system with full disk encryption. I've written a script (to run on every boot) which will verify that neither the MBR or /boot partition (ext4) has been modified.
Problem is that every time I boot up the system, my /boot partition hashes differently.
Trying to solve this, I set the /boot partition to mount as read only in fstab. I then took individual hashes of every file on /boot. After I rebooted none of the files had changed (and there were no new files), yet the filesystem hashed as a whole had changed.
I'm guessing there is something behind the scenes which is changed/updated each time the filesystem is mounted? If so, can it be disabled?
Any advice would be greatly appreciated!
Cheers,
Lee
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: EXT4 partition changes every time it's mounted. (How to stop this?)
2011-05-21 19:45 EXT4 partition changes every time it's mounted. (How to stop this?) Lee Davis
@ 2011-05-22 11:47 ` Theodore Tso
2011-05-23 4:39 ` Lee Davis
0 siblings, 1 reply; 4+ messages in thread
From: Theodore Tso @ 2011-05-22 11:47 UTC (permalink / raw)
To: Lee Davis; +Cc: linux-ext4
On May 21, 2011, at 3:45 PM, Lee Davis wrote:
> I'm setting up a Linux system with full disk encryption. I've written a script (to run on every boot) which will verify that neither the MBR or /boot partition (ext4) has been modified.
>
> Problem is that every time I boot up the system, my /boot partition hashes differently.
>
> I'm guessing there is something behind the scenes which is changed/updated each time the filesystem is mounted? If so, can it be disabled?
Yes, there is a last mounted time in the superblock. If you mount the file system read-only, then not only will that field not be changed, but you can guarantee that nothing else will change...
-- Ted
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: EXT4 partition changes every time it's mounted. (How to stop this?)
2011-05-22 11:47 ` Theodore Tso
@ 2011-05-23 4:39 ` Lee Davis
2011-05-26 6:15 ` Lee Davis
0 siblings, 1 reply; 4+ messages in thread
From: Lee Davis @ 2011-05-23 4:39 UTC (permalink / raw)
To: Theodore Tso; +Cc: linux-ext4
Hi Ted,
I've checked again, and despite being mounted read-only, the filesystem is definitely changing every time I reboot.
The mount options are: ro,relatime,commit=0
I've taken three images of the filesystem (rebooting between each image), and with a bit of research I've managed to discover which fields in the superblock are being changed. They are: s_wtime and s_kbytes_written.
Here's how they're being changed:
0x430 (s_wtime): 06C8D94D -> 68D0D94D -> B9D7D94D
0x578 (s_kbytes_written): 42C8000000000000 -> 45C8000000000000 -> 48C8000000000000
These two fields are the only things that are changing in the entire filesystem.
Any ideas on what might be causing this and/or how to disable it?
Much appreciated,
Lee
P.S. I just thought to test it after unmounting/re-mounting, and nothing was changed. So it appears to only get changed when I boot the system.
It's a fresh Ubuntu Natty installation, with GRUB on the MBR, an ext4 boot partition, and an encrypted ext4 root partition (which I set up through the installer). I can't think what might be writing to the boot partition.
----- Original Message -----
From: Theodore Tso <tytso@MIT.EDU>
To: Lee Davis <l.davis37@ymail.com>
Cc: "linux-ext4@vger.kernel.org" <linux-ext4@vger.kernel.org>
Sent: Sunday, 22 May 2011 9:47 PM
Subject: Re: EXT4 partition changes every time it's mounted. (How to stop this?)
On May 21, 2011, at 3:45 PM, Lee Davis wrote:
> I'm setting up a Linux system with full disk encryption. I've written a script (to run on every boot) which will verify that neither the MBR or /boot partition (ext4) has been modified.
>
> Problem is that every time I boot up the system, my /boot partition hashes differently.
>
> I'm guessing there is something behind the scenes which is changed/updated each time the filesystem is mounted? If so, can it be disabled?
Yes, there is a last mounted time in the superblock. If you mount the file system read-only, then not only will that field not be changed, but you can guarantee that nothing else will change...
-- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: EXT4 partition changes every time it's mounted. (How to stop this?)
2011-05-23 4:39 ` Lee Davis
@ 2011-05-26 6:15 ` Lee Davis
0 siblings, 0 replies; 4+ messages in thread
From: Lee Davis @ 2011-05-26 6:15 UTC (permalink / raw)
To: Lee Davis, Theodore Tso; +Cc: linux-ext4
I've just tested this on a clean Ubuntu installation without any crypto -- exact same thing happens. Should I log this as an ext4 bug?
Regards,
Lee
----- Original Message -----
From: Lee Davis <l.davis37@ymail.com>
To: Theodore Tso <tytso@MIT.EDU>
Cc: "linux-ext4@vger.kernel.org" <linux-ext4@vger.kernel.org>
Sent: Monday, 23 May 2011 2:39 PM
Subject: Re: EXT4 partition changes every time it's mounted. (How to stop this?)
Hi Ted,
I've checked again, and despite being mounted read-only, the filesystem is definitely changing every time I reboot.
The mount options are: ro,relatime,commit=0
I've taken three images of the filesystem (rebooting between each image), and with a bit of research I've managed to discover which fields in the superblock are being changed. They are: s_wtime and s_kbytes_written.
Here's how they're being changed:
0x430 (s_wtime): 06C8D94D -> 68D0D94D -> B9D7D94D
0x578 (s_kbytes_written): 42C8000000000000 -> 45C8000000000000 -> 48C8000000000000
These two fields are the only things that are changing in the entire filesystem.
Any ideas on what might be causing this and/or how to disable it?
Much appreciated,
Lee
P.S. I just thought to test it after unmounting/re-mounting, and nothing was changed. So it appears to only get changed when I boot the system.
It's a fresh Ubuntu Natty installation, with GRUB on the MBR, an ext4 boot partition, and an encrypted ext4 root partition (which I set up through the installer). I can't think what might be writing to the boot partition.
----- Original Message -----
From: Theodore Tso <tytso@MIT.EDU>
To: Lee Davis <l.davis37@ymail.com>
Cc: "linux-ext4@vger.kernel.org" <linux-ext4@vger.kernel.org>
Sent: Sunday, 22 May 2011 9:47 PM
Subject: Re: EXT4 partition changes every time it's mounted. (How to stop this?)
On May 21, 2011, at 3:45 PM, Lee Davis wrote:
> I'm setting up a Linux system with full disk encryption. I've written a script (to run on every boot) which will verify that neither the MBR or /boot partition (ext4) has been modified.
>
> Problem is that every time I boot up the system, my /boot partition hashes differently.
>
> I'm guessing there is something behind the scenes which is changed/updated each time the filesystem is mounted? If so, can it be disabled?
Yes, there is a last mounted time in the superblock. If you mount the file system read-only, then not only will that field not be changed, but you can guarantee that nothing else will change...
-- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2011-05-26 6:15 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-05-21 19:45 EXT4 partition changes every time it's mounted. (How to stop this?) Lee Davis
2011-05-22 11:47 ` Theodore Tso
2011-05-23 4:39 ` Lee Davis
2011-05-26 6:15 ` Lee Davis
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.