Received-SPF: pass (google.com: domain of linux-ext4-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Andreas Dilger <adilger@dilger.ca>
Message-Id: <A08FAD7B-899F-4B40-9881-2ACD45399471@dilger.ca>
Content-Type: multipart/signed;
 boundary="Apple-Mail=_CCF7291D-06B5-4958-B224-FDE3E7584013";
 protocol="application/pgp-signature"; micalg=pgp-sha256
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Subject: Re: [PATCH 1/2] ext4: wipe filename upon file deletion
Date:   Fri, 26 Mar 2021 17:05:16 -0600
In-Reply-To: <20210325181220.1118705-1-leah.rumancik@gmail.com>
Cc:     linux-ext4@vger.kernel.org, tytso@mit.edu
To:     Leah Rumancik <leah.rumancik@gmail.com>
References: <20210325181220.1118705-1-leah.rumancik@gmail.com>
Precedence: bulk


--Apple-Mail=_CCF7291D-06B5-4958-B224-FDE3E7584013
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=us-ascii

On Mar 25, 2021, at 12:12 PM, Leah Rumancik <leah.rumancik@gmail.com> =
wrote:
>=20
> Zero out filename field when file is deleted. Also, add mount option
> nowipe_filename to disable this filename wipeout if desired.

I would personally be against "wipe out entries on delete" as the =
default
behavior.  I think most users would prefer that their data is maximally
recoverable, rather than the minimal security benefit of erasing deleted
content by default.

I think that Darrick made a good point that using the EXT4_SECRM_FL on
the inode gives users a good option to enable/disable this on a per
file or directory basis.

> Signed-off-by: Leah Rumancik <leah.rumancik@gmail.com>
> ---
> fs/ext4/ext4.h  |  1 +
> fs/ext4/namei.c |  4 ++++
> fs/ext4/super.c | 11 ++++++++++-
> 3 files changed, 15 insertions(+), 1 deletion(-)
>=20
> diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
> index 826a56e3bbd2..8011418176bc 100644
> --- a/fs/ext4/ext4.h
> +++ b/fs/ext4/ext4.h
> @@ -1247,6 +1247,7 @@ struct ext4_inode_info {
> #define EXT4_MOUNT2_JOURNAL_FAST_COMMIT	0x00000010 /* Journal =
fast commit */
> #define EXT4_MOUNT2_DAX_NEVER		0x00000020 /* Do not allow =
Direct Access */
> #define EXT4_MOUNT2_DAX_INODE		0x00000040 /* For printing =
options only */
> +#define EXT4_MOUNT2_WIPE_FILENAME       0x00000080 /* Wipe filename =
on del entry */
>=20
>=20
> #define clear_opt(sb, opt)		EXT4_SB(sb)->s_mount_opt &=3D \
> diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
> index 883e2a7cd4ab..ae6ecabd4d97 100644
> --- a/fs/ext4/namei.c
> +++ b/fs/ext4/namei.c
> @@ -2492,6 +2492,10 @@ int ext4_generic_delete_entry(struct inode =
*dir,
> 			else
> 				de->inode =3D 0;
> 			inode_inc_iversion(dir);
> +
> +			if (test_opt2(dir->i_sb, WIPE_FILENAME))
> +				memset(de_del->name, 0, =
de_del->name_len);
> +
> 			return 0;
> 		}
> 		i +=3D ext4_rec_len_from_disk(de->rec_len, blocksize);
> diff --git a/fs/ext4/super.c b/fs/ext4/super.c
> index b9693680463a..5e8737b3f171 100644
> --- a/fs/ext4/super.c
> +++ b/fs/ext4/super.c
> @@ -1688,7 +1688,7 @@ enum {
> 	Opt_dioread_nolock, Opt_dioread_lock,
> 	Opt_discard, Opt_nodiscard, Opt_init_itable, Opt_noinit_itable,
> 	Opt_max_dir_size_kb, Opt_nojournal_checksum, Opt_nombcache,
> -	Opt_prefetch_block_bitmaps,
> +	Opt_prefetch_block_bitmaps, Opt_nowipe_filename,
> #ifdef CONFIG_EXT4_DEBUG
> 	Opt_fc_debug_max_replay, Opt_fc_debug_force
> #endif
> @@ -1787,6 +1787,7 @@ static const match_table_t tokens =3D {
> 	{Opt_test_dummy_encryption, "test_dummy_encryption"},
> 	{Opt_inlinecrypt, "inlinecrypt"},
> 	{Opt_nombcache, "nombcache"},
> +	{Opt_nowipe_filename, "nowipe_filename"},
> 	{Opt_nombcache, "no_mbcache"},	/* for backward compatibility */
> 	{Opt_prefetch_block_bitmaps, "prefetch_block_bitmaps"},
> 	{Opt_removed, "check=3Dnone"},	/* mount option from ext2/3 */
> @@ -2007,6 +2008,8 @@ static const struct mount_opts {
> 	{Opt_max_dir_size_kb, 0, MOPT_GTE0},
> 	{Opt_test_dummy_encryption, 0, MOPT_STRING},
> 	{Opt_nombcache, EXT4_MOUNT_NO_MBCACHE, MOPT_SET},
> +	{Opt_nowipe_filename, EXT4_MOUNT2_WIPE_FILENAME, MOPT_CLEAR | =
MOPT_2 |
> +		MOPT_EXT4_ONLY},
> 	{Opt_prefetch_block_bitmaps, EXT4_MOUNT_PREFETCH_BLOCK_BITMAPS,
> 	 MOPT_SET},
> #ifdef CONFIG_EXT4_DEBUG
> @@ -2621,6 +2624,10 @@ static int _ext4_show_options(struct seq_file =
*seq, struct super_block *sb,
> 	} else if (test_opt2(sb, DAX_INODE)) {
> 		SEQ_OPTS_PUTS("dax=3Dinode");
> 	}
> +
> +	if (!test_opt2(sb, WIPE_FILENAME))
> +		SEQ_OPTS_PUTS("nowipe_filename");
> +
> 	ext4_show_quota_options(seq, sb);
> 	return 0;
> }
> @@ -4161,6 +4168,8 @@ static int ext4_fill_super(struct super_block =
*sb, void *data, int silent)
> 	if (def_mount_opts & EXT4_DEFM_DISCARD)
> 		set_opt(sb, DISCARD);
>=20
> +	set_opt2(sb, WIPE_FILENAME);
> +
> 	sbi->s_resuid =3D make_kuid(&init_user_ns, =
le16_to_cpu(es->s_def_resuid));
> 	sbi->s_resgid =3D make_kgid(&init_user_ns, =
le16_to_cpu(es->s_def_resgid));
> 	sbi->s_commit_interval =3D JBD2_DEFAULT_MAX_COMMIT_AGE * HZ;
> --
> 2.31.0.291.g576ba9dcdaf-goog
>=20


Cheers, Andreas


--Apple-Mail=_CCF7291D-06B5-4958-B224-FDE3E7584013
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org

iQIzBAEBCAAdFiEEDb73u6ZejP5ZMprvcqXauRfMH+AFAmBeaKwACgkQcqXauRfM
H+D3PxAAnZLZTVDC4x476mfPsstd9H7pika+OjM6YrbnjjiKqQwxOmWzHSFUrGjN
xn0RJzwlo/5iqiLlTDMwQVvtSmvUont/7PMnSUIwsOELmdN07cpNvT0OOWXx44AC
6FFESxCRxg3f3uy3/3tzwlG0S1j6UTFqEHDR8NpfrhRp3nqf9bTMqJ7n+Y1hYAkJ
GltugyFdd9SpV3/B48MUDuEeAL4rb0S5zYjOJSWdJKnY6XszS/44QQeLvHXxJiQD
PeZttR8lHiZE6Ey7IEhWEUhcvsemgk3X1psu0LE4LTs/8I8YzD6C/2w+dxjXpk3R
NgiIUJuqa9x4hwjAe2Bt+Ht0DsyKNiZAutXIee81WjWP4iDSmA7c24REwxz5p22M
yzidkItx2wddYNm5u9tAfs+PbtlraHfBu3yMXEHlZHVo4VoN6mmABlTxam7SQvNs
CkqkBbsvX2Hzw7phW6gmd1eOuqLVyFkBMFdmVOsM8ZKzZLUgqTqz0hPvXbFe5NSI
ZHBDhQ/vsvr53c6yUvEKqXafDFAIXkHtmG0LgIul0UpL4xfHFuQ1QSH953kFwyhD
T7qSW/tDwlCr53PT0TLDeLVD9gkdGUHA2fS/++msSLTNBPwAUKn6hKfJBVJsbONY
WNA0HD5PepP2eQH6xETWPTJwk+6iODxJiuvHTyO8oSeFpRCTfYU=
=mZZP
-----END PGP SIGNATURE-----

--Apple-Mail=_CCF7291D-06B5-4958-B224-FDE3E7584013--