Received-SPF: pass (google.com: domain of linux-ext4+bounces-832-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: Andreas Dilger <adilger@dilger.ca>
Message-Id: <4F9ECC50-EE67-44D6-816D-81F6EB840A69@dilger.ca>
Content-Type: multipart/signed;
 boundary="Apple-Mail=_750805AA-7EA4-401C-8400-BECA3CEEE5B4";
 protocol="application/pgp-signature"; micalg=pgp-sha256
Precedence: bulk
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Subject: Re: Protecting lost+found from rmdir by directory owner?
Date: Tue, 16 Jan 2024 19:31:03 -0700
In-Reply-To: <42bc44533e997531baa79c73867a942504122886.camel@interlinx.bc.ca>
Cc: Ext4 Developers List <linux-ext4@vger.kernel.org>
To: "Brian J. Murrell" <brian@interlinx.bc.ca>
References: <42bc44533e997531baa79c73867a942504122886.camel@interlinx.bc.ca>


--Apple-Mail=_750805AA-7EA4-401C-8400-BECA3CEEE5B4
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=us-ascii

On Jan 16, 2024, at 6:26 AM, Brian J. Murrell <brian@interlinx.bc.ca> wrote:
> 
> Let's say I create a new ext4 filesystem for exclusive use by alice and
> when I mount it, say, on /mnt/alice I set the permissions so that alice
> can work in that directory:
> 
> # mkfs.ext4 /dev/foo
> # mount /dev/foo /mnt/alice
> # chown alice:alice /mnt/alice
> # chmod 775 /mnt/alice
> 
> But now /mnt/alice/lost+found is at the mercy of alice since she has
> write permission for /mnt/alice.
> 
> [How] can I protect /mnt/alice/lost+found from removal by alice?

You might be able to mark the directory with "chattr +a lost+found"
(append only) so that new files can be written there but not deleted
even with malice, except by the root user.  Not 100% sure that

It would be useful to have a patch that allowed that directory to be
renamed ".lost+found" so that it is not visible in normal "ls" by
users, but still available for e2fsck to store files if needed, since
it would be very unlikely to be deleted in the first place if hidden.

I'd expect that it would be a few lines patch to e2fsck to check both
names, and a new mke2fs option like "-E hidden_lost_found" and allow
it to be renamed by "mv" on existing filesystems.

Cheers, Andreas


--Apple-Mail=_750805AA-7EA4-401C-8400-BECA3CEEE5B4
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org

iQIzBAEBCAAdFiEEDb73u6ZejP5ZMprvcqXauRfMH+AFAmWnO+cACgkQcqXauRfM
H+CXkA/9EVh+z5XCj7fythD1k9uyGNNAl1w4f3bHZ2antLfgglzLDtEJdqZ0FwxI
uIY3XV8P+sLNC8oD+9mfndxJym/6frpQ3ulfy/I7Rl41K6cv9Qg3MUIQ9MepcN9G
58ZpsN6qlVXBS4mFZkDNO5cKOU6qn8XDsOw/NnfQjBjCLfP3sGF4IKHiAzR9Nofk
WGtpc9wpMGB3oRC2hraQpS40xsJq857Xm3skFNmHutz06rGwZys17nn1G7nPau1H
o7pP3jBy56lBLw3vTR9lwzzQ7YPwFyOyVu4AtCzVmvNmIGdgLL7B1LcqCibT9RVy
VbSEeE/f46Y6RtkPzF7TsSoggeuxuyffEyp8aOmGDw+yUk74g4azqm4PNZoFqZ24
iJxobmUMaJe+mu45Abmj1+eSJXKgMEmvgNic8ZQcxKLLqwLtb/UCzK8pkDTT81eg
g5lEF7SYULCR/3gPEV+8CaYpatls9gBiF4OJfawtzC8mKts4FbFFyjfZTbo3ACyE
DV7+4aRHoX5ftLHWAy0zyIdEu69V+QCAqq2PTv0O+NYXLpoMpEuCoHup4ybJQFsH
iTnSpnQrEVT0JN8Txp5vDxRW0twAzMiFTslX6rp+Gf4F380sEw3Da9D02LM7tbfa
fpBvdbSfBzfo20T4vZkrsVc0yV5QQ61PdUupWqNd5M7Hj7wsR+0=
=6oS8
-----END PGP SIGNATURE-----

--Apple-Mail=_750805AA-7EA4-401C-8400-BECA3CEEE5B4--