On Feb 17, 2019, at 8:35 AM, Boaz Harrosh <[email protected]> wrote:
>
> On 15/02/19 00:06, Dave Chinner wrote:
>> On Thu, Feb 14, 2019 at 02:00:07AM -0800, Omar Sandoval wrote:
>>> From: Omar Sandoval <[email protected]>
>>>
>>> Hi,
>>>
>>> Since statx was added in 4.11, userspace has had an interface for
>>> reading btime (file creation time), but no way to set it. This RFC patch
>>> series adds support for changing btime with utimensat(). Patch 1 adds
>>> the VFS infrastructure, patch 2 adds the support to utimensat() with a
>>> new flag, and the rest of the patches add filesystem support; I excluded
>>> CIFS for now because I don't have a CIFS setup to test it on.
>>>
>>> Updating btime is useful for at least a couple of use cases:
>>>
> [1]
>>> - Backup/restore programs (my motivation for this feature is btrfs send)
>>> - File servers which interoperate with operating systems that allow
>>> updating file creation time, including Mac OS [1] and Windows [2]
>>
>> So you're adding an interface that allows users to change the create
>> time of files without needing any privileges?
>>
> [2]
>> Inode create time is forensic metadata in XFS - information we use
>> for sequence of event and inode lifetime analysis during examination
>> of broken filesystem images and systems that have been broken into.
>> Just because it's exposed to userspace via statx(), it doesn't mean
>> that it is information that users should be allowed to change. i.e.
>> allowing users to be able to change the create time on files makes
>> it completely useless for the purpose it was added to XFS for...
>>
> <snap>
>
> I think the difference in opinion here is that there are two totally
> different BTIme out in the world. For two somewhat opposite motivations
> and it seems they both try to be crammed into the same on disk space.
>
> One - Author creation time
> This is a Windows originated creature and later MAC (and all vendors who
> make a living by serving cifs (hint see my email address))
>
> This is a tag carried globally on the globe denoting the time of the
> original creator of the file. copy, download, backup-restore and so
> on preserve it from the very first original creation.
> This creature is a user oriented information. That needs to be carefully
> orchestrated by all parties.

One of the issues with user-supplied "creation time" is that it is vague.
If Vim (or many other programs) is writing out an existing file, it
will actually create a new file and rename it over the old file, so even
though the newly-written file is "created" at write time, the content is
older. Unless the creation time is actually stored internal to the file
itself, rather than as filesystem metadata, it is unlikely to be kept
across filesystems, between systems, etc.

Conversely, there is already such metadata in existing file formats, e.g.
.jpg (Exif.Image.DateTime), .png (tEXt Creation Time), .docx (Date Completed),
etc. that sticks with the file regardless of the underlying storage medium.

Cheers, Andreas

Attachments:

signature.asc (873.00 B)
Message signed with OpenPGP

2019-02-22 15:01:13

by David Sterba

[permalink] [raw]

Subject: Re: [RFC PATCH 0/6] Allow setting file birth time with utimensat()

On Thu, Feb 14, 2019 at 02:00:07AM -0800, Omar Sandoval wrote:
> From: Omar Sandoval <[email protected]>
> Since statx was added in 4.11, userspace has had an interface for
> reading btime (file creation time), but no way to set it. This RFC patch
> series adds support for changing btime with utimensat(). Patch 1 adds
> the VFS infrastructure, patch 2 adds the support to utimensat() with a
> new flag, and the rest of the patches add filesystem support; I excluded
> CIFS for now because I don't have a CIFS setup to test it on.
>
> Updating btime is useful for at least a couple of use cases:
>
> - Backup/restore programs (my motivation for this feature is btrfs send)
> - File servers which interoperate with operating systems that allow
> updating file creation time, including Mac OS [1] and Windows [2]

I don't have anything new to add to what has been said in the thread.
The creation time is property of the filesystem and if user wants to
track additional metadata, then as external attributes.

2019-02-22 19:00:53

by Omar Sandoval

[permalink] [raw]

Subject: Re: [RFC PATCH 0/6] Allow setting file birth time with utimensat()

On Tue, Feb 19, 2019 at 09:18:20AM +1100, Dave Chinner wrote:
> On Sat, Feb 16, 2019 at 06:57:45PM -0700, Andreas Dilger wrote:
> > While it may be a bit of a stretch to call this "forensic evidence", making
>
> We do forensic analysis of corrupt filesystems looking for evidence
> of what went wrong, not just looking for evidence of what happened
> on systems that have been broken into.
>
> > it hard to change from except via total root compromise by a skilled hacker
> > is very useful.
>
> *nod*.
>
> > If this were to go in (which I'm not in favour of), then there would need to
> > be a CONFIG and/or runtime knob to turn it off (or better to only turn it on),
> > similar to how FIPS and other security options can only go in one direction.
>
> The problem here is that "inode birth time" is being conflated with
> "user document creation time". These two things are very different.
>
> i.e. One is filesystem internal information and is not related to
> when the original copy of the data in the file was created, the
> other is user specified metadata that is related to the file data
> contents and needs to travel with the data, not the filesystem.
>
> IMO, trying to make one on-disk field hold two different types of
> information defeats one or the other purpose, and nobody knows which
> one the field stores for any given file.
>
> I'd suggest that "authored date" should be a generic system xattr so
> most filesystems support it, not just those that have a birth time
> field on disk. Sure, modify it through utimesat() and expose it
> through statx() (as authored time, not birth time), but store it a
> system xattr rather than an internal filesystem metadata field that
> requires was never intended to be user modifiable.

It seems that this is the general consensus, so I'll look into
implementing this functionality as an xattr.

2019-02-23 18:32:24

by Andreas Dilger

[permalink] [raw]

Subject: Re: [RFC PATCH 0/6] Allow setting file birth time with utimensat()

> On Feb 22, 2019, at 11:00 AM, Omar Sandoval <[email protected]> wrote:
>
> On Tue, Feb 19, 2019 at 09:18:20AM +1100, Dave Chinner wrote:
>> On Sat, Feb 16, 2019 at 06:57:45PM -0700, Andreas Dilger wrote:
>>> While it may be a bit of a stretch to call this "forensic evidence",
>>
>> We do forensic analysis of corrupt filesystems looking for evidence
>> of what went wrong, not just looking for evidence of what happened
>> on systems that have been broken into.
>>
>>> making it hard to change from except via total root compromise by a
>>> skilled hacker is very useful.
>>
>> *nod*.
>>
>>> If this were to go in (which I'm not in favour of), then there would
>>> need to be a CONFIG and/or runtime knob to turn it off (or better to
>>> only turn it on), similar to how FIPS and other security options can
>>> only go in one direction.
>>
>> The problem here is that "inode birth time" is being conflated with
>> "user document creation time". These two things are very different.
>>
>> i.e. One is filesystem internal information and is not related to
>> when the original copy of the data in the file was created, the
>> other is user specified metadata that is related to the file data
>> contents and needs to travel with the data, not the filesystem.
>>
>> IMO, trying to make one on-disk field hold two different types of
>> information defeats one or the other purpose, and nobody knows which
>> one the field stores for any given file.
>>
>> I'd suggest that "authored date" should be a generic system xattr so
>> most filesystems support it, not just those that have a birth time
>> field on disk. Sure, modify it through utimesat() and expose it
>> through statx() (as authored time, not birth time), but store it a
>> system xattr rather than an internal filesystem metadata field that
>> requires was never intended to be user modifiable.
>
> It seems that this is the general consensus, so I'll look into
> implementing this functionality as an xattr.

I would recommend to look at how Samba is storing these attributes
today, and do the same thing, maybe add support into GNU coreutils
to handle this transparently.

Cheers, Andreas

Attachments:

signature.asc (873.00 B)
Message signed with OpenPGP