All of lore.kernel.org
 help / color / mirror / Atom feed
From: Andreas Dilger <adilger@dilger.ca>
To: Amir Goldstein <amir73il@gmail.com>
Cc: Allison Henderson <achender@linux.vnet.ibm.com>,
	"linux-ext4@vger.kernel.org" <linux-ext4@vger.kernel.org>
Subject: Re: [PATCH 1/2 v3] EXT4: Secure Delete: Zero out file data
Date: Mon, 4 Jul 2011 12:19:00 -0600	[thread overview]
Message-ID: <9EC28987-9A72-4753-8822-A138C5F0E622@dilger.ca> (raw)
In-Reply-To: <CAOQ4uxjwHeP3DqgbW2mJ8wBi=HBcDd-UTaZ=XTsSAcH+jdNvJQ@mail.gmail.com>

On 2011-07-04, at 11:44 AM, Amir Goldstein wrote:
> On Mon, Jul 4, 2011 at 8:19 PM, Allison Henderson
> <achender@linux.vnet.ibm.com> wrote:
>> 
>> Thx all for the reviews!  It sounds like the zero out code is in the right
>> spot then.  We are thinking about adding an optimization too, where we use
>> use secure discard instead of the sb_issue_zeroout, but only if the device
>> supports it.  I was thinking about putting that code some where in the
>> commit call back because that is where the existing discard code is, but
>> maybe that's not such a good place to put it then?  What does everyone
>> think?  Thx!
> 
> I already stated my opinion about the need for 2-phase secure delete.
> If you have to choose between security (zeroout pre commit) and the
> atomicity of the unlink() command (zeroout post commit), then it's
> a question of policy.
> Is there any other FS (or OS) that implements secure delete?
> Perhaps we could follow its semantics.

One thing we did ages ago, before extent-mapped files made unlink so
fast, was to move the blocks from unlinked files and truncated-to-zero
files to a delete queue in the main transaction, and then do the unlink
via a separate thread.

This facility could be resurrected (a version of the patch was posted to
linux-ext4 at http://www.spinics.net/lists/linux-ext4/msg06178.html) to
do the block zeroing/discard in the context of the unlink thread.  It
could be structured so that sync/fsync on the file waits for background
zeroing to complete, so that apps doing secure delete + fsync will be
sure that the file is safely erased.  The fsync would be needed for this
in any case, otherwise even an inline async zero-fill could fail if the
system crashes before the blocks are actually flushed to disk.

Cheers, Andreas






  reply	other threads:[~2011-07-04 18:19 UTC|newest]

Thread overview: 36+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-06-30 21:22 [PATCH 0/2 v3] EXT4: Secure Delete Allison Henderson
2011-06-30 21:22 ` [PATCH 1/2 v3] EXT4: Secure Delete: Zero out file data Allison Henderson
2011-06-30 22:15   ` Andreas Dilger
2011-07-01  0:54     ` Allison Henderson
2011-07-01  1:18       ` Martin K. Petersen
2011-07-01  1:41         ` Allison Henderson
2011-07-01 10:26   ` Lukas Czerner
2011-07-01 16:21     ` Allison Henderson
2011-07-02  9:33   ` Amir Goldstein
2011-07-03  7:00     ` Andreas Dilger
2011-07-03  7:37       ` Amir Goldstein
2011-07-04 17:19         ` Allison Henderson
2011-07-04 17:44           ` Amir Goldstein
2011-07-04 18:19             ` Andreas Dilger [this message]
2011-07-04 19:09               ` Allison Henderson
2011-07-06 21:05     ` Allison Henderson
2011-07-07  7:05       ` Amir Goldstein
2011-07-07 19:52         ` Andreas Dilger
2011-07-07 20:19           ` Allison Henderson
2011-07-08  0:09             ` Amir Goldstein
2011-07-08  1:55               ` Allison Henderson
2011-07-08  6:29                 ` Amir Goldstein
2011-07-08 20:43                   ` Allison Henderson
2011-07-10 23:13                   ` Ted Ts'o
2011-07-11 10:01                     ` Amir Goldstein
2011-07-08  2:46               ` Andreas Dilger
2011-07-08  5:46                 ` Ric Wheeler
2011-07-08  6:11                 ` Amir Goldstein
2011-07-08 18:20               ` Mingming Cao
2011-07-08 23:49                 ` Andreas Dilger
2011-07-10  8:19                   ` Ric Wheeler
2011-07-10 23:33                     ` Ted Ts'o
2011-07-11  6:42                       ` Ric Wheeler
2011-07-11  8:20                         ` Lukas Czerner
2011-07-11 14:24                           ` Allison Henderson
2011-06-30 21:22 ` [PATCH 2/2 v3] EXT4: Secure Delete: Zero out files directory entry Allison Henderson

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=9EC28987-9A72-4753-8822-A138C5F0E622@dilger.ca \
    --to=adilger@dilger.ca \
    --cc=achender@linux.vnet.ibm.com \
    --cc=amir73il@gmail.com \
    --cc=linux-ext4@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.