From: Russ Dill <Russ.Dill@gmail.com>
To: linux-kernel@vger.kernel.org
Subject: Re: [PATCH 0/5] RFC: Offer a way for userspace to request real deletion of files
Date: Sat, 7 Feb 2015 05:56:45 +0000 (UTC) [thread overview]
Message-ID: <loom.20150207T064727-832@post.gmane.org> (raw)
In-Reply-To: 54D4B0E0.6050806@ahsoftware.de
Alexander Holler <holler <at> ahsoftware.de> writes:
>
> Hello.
>
> I've set up a repository at github which contains the 3 pathches to add
> limited support to the Linux kernel for wiping files on ext4 and (v)fat
> with 3 small patches and a total of "9 files changed, 101 insertions(+),
> 8 deletions(-)" here:
>
> https://github.com/aholler/wipe_lnx
>
> Feel free to send me any comments, patches or even flames in privat
> (off-list)! because I don't want to become involved in annoying
> discussions here anymore.
>
> Alexander Holler
>
This is certainly a case of "The Emperor's New Clothes". Lets say I use vim to
edit my file containing my deep dark secrets. Lets strace it and see what
happens when I edit it and save a new copy:
rename("secure_document.txt", "secure_document.txt~") = 0
open("secure_document.txt", O_WRONLY|O_CREAT|O_TRUNC, 0664) = 3
write(3, "secrete:s\n", 10) = 10
fsync(3) = 0
close(3) = 0
chmod("secure_document.txt", 0100664) = 0
setxattr("secure_document.txt", "system.posix_acl_access",
"\x02\x00\x00\x00\x01\x00\x06\x00\xff\xff\xff\xff\x04\x00\x06\x00\xff\xff\xff\x
ff \x00\x04\x00\xff\xff\xff\xff", 28, 0) = 0
unlink("secure_document.txt~") = 0
You'll find that just about every program that deals with files properly does
something like this. If it didn't, there'd be a good chance of losing all your
work if the computer or program crashed while saving your file. This is layer
one of the problem.
Layer 2 is filesystems, as others have noted, filesystems have all sorts of
paths for blocks no longer being associated with inodes. Log structured file
systems doubly so.
And layer 3, media, which we have no control over and may be storing duplicate
copies of the data for any number of reasons. But as you've pointed out, is
likely to require significant funds to get at.
As pointed out, the best you could do is some sort of flag on the inode that
instructed the filesystem to wipe blocks before separating them from the inode.
Programs would need to be modified though as you can see in the vim case, any
copying of file mode bits are only done after data has been written to disk.
Luckily there is an easy solution out there that solves all these problems.
next prev parent reply other threads:[~2015-02-07 5:56 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-02-02 17:05 [PATCH 0/5] RFC: Offer a way for userspace to request real deletion of files Alexander Holler
2015-02-02 17:05 ` [PATCH 1/5] WIP: Add syscall unlinkat_s (currently x86* only) Alexander Holler
2015-02-03 6:05 ` Al Viro
2015-02-03 6:58 ` Alexander Holler
2015-02-03 7:56 ` Al Viro
2015-02-03 8:01 ` Alexander Holler
2015-02-03 8:10 ` Al Viro
2015-02-03 8:17 ` Alexander Holler
2015-02-03 8:51 ` Alexander Holler
2015-02-03 9:23 ` Alexander Holler
2015-02-03 12:48 ` Alexander Holler
2015-02-03 12:54 ` Alexander Holler
2015-02-03 17:48 ` Theodore Ts'o
2015-02-03 18:01 ` Alexander Holler
2015-02-03 23:33 ` Al Viro
2015-02-04 0:18 ` Alex Elsayed
2015-02-04 4:16 ` Andreas Dilger
2015-02-04 10:19 ` Alexander Holler
2015-02-04 12:07 ` Lukáš Czerner
2015-02-04 12:22 ` Alexander Holler
2015-02-04 12:42 ` Alexander Holler
2015-02-04 12:50 ` Alexander Holler
2015-02-04 13:07 ` Alexander Holler
2015-02-04 13:06 ` Michael Kerrisk
2015-02-04 13:21 ` Alexander Holler
2015-02-04 13:29 ` Alexander Holler
2015-02-04 14:19 ` Alexander Holler
2015-02-04 15:00 ` Austin S Hemmelgarn
2015-02-04 14:52 ` Lukáš Czerner
2015-02-04 16:12 ` Alexander Holler
2015-02-04 16:25 ` Lukáš Czerner
2015-02-04 16:45 ` Alexander Holler
2015-02-04 16:53 ` Alexander Holler
2015-02-04 19:33 ` Theodore Ts'o
2015-02-04 19:56 ` Alexander Holler
2015-02-03 7:58 ` Davidlohr Bueso
2015-02-03 7:52 ` Alexander Holler
2015-02-04 8:01 ` Michael Kerrisk
2015-02-02 17:05 ` [PATCH 2/5] WIP: fs: fat: support unlinkat_s() for secure deletion of files Alexander Holler
2015-02-02 17:05 ` [PATCH 3/5] WIP: fs: ext4: " Alexander Holler
2015-02-03 13:50 ` Lukáš Czerner
2015-02-03 14:50 ` Alexander Holler
2015-02-03 15:13 ` Alexander Holler
2015-02-03 15:24 ` Alexander Holler
2015-02-03 15:41 ` Lukáš Czerner
2015-02-03 15:46 ` Alexander Holler
2015-02-03 16:38 ` Alexander Holler
2015-02-03 18:50 ` Alexander Holler
2015-02-02 17:05 ` [PATCH 4/5] WIP: Add patch for coreutils to support unlinkat_s (x86_64 only) Alexander Holler
2015-02-02 17:05 ` [PATCH 5/5] WIP: Add test for unlinkat_s Alexander Holler
2015-02-03 15:15 ` [PATCH 0/5] RFC: Offer a way for userspace to request real deletion of files One Thousand Gnomes
2015-02-03 15:45 ` Alexander Holler
2015-02-04 8:01 ` Michael Kerrisk
2015-02-06 12:17 ` Alexander Holler
2015-02-07 5:56 ` Russ Dill [this message]
2015-03-02 10:03 ` Alexander Holler
2015-03-03 10:36 ` Alexander Holler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=loom.20150207T064727-832@post.gmane.org \
--to=russ.dill@gmail.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).