Re: [PATCH] COW and checksumming ioctls

[Josef Bacik <jbacik@redhat.com>]

On Fri, Jun 20, 2008 at 08:01:54AM -0600, Joe Peterson wrote:
> Zach Brown wrote:
> > Hmm.  Do we really want 4 different ioctl commands to turn 2 features on
> > and off?  Surely we could have 1 ioctl which updates a bitfield?  Or a
> > ioctl that takes an explicit feature enum argument and a boolean which
> > indicates that it should be enabled or not?
> > 
> > (And is ioctl the right interface for this?  maybe it should be xattr
> > ops in some defined btrfs string namespace?  I'm just making this up.  I
> > feel the the lack of a single comment in the patch, while in keeping
> > with the existing precedent in btrfs, leaves a lot of room for wild
> > speculation :))
> 
> Beyond that, is it really desirable to be able to turn off
> checksumming/COW per file?  Or even to be able to do it so easily?
>

Database apps that do their own complicated stuff to make sure everything makes
it to the disk properly who dont want the extra overhead of checksumming.
 
> I feel that checksumming is an extremely important feature, and it
> scares me even to be able to disable it at all (what if someone
> mistakenly does it, and then all of the data is unintentionally
> vulnerable?).  But at least if it is only a mount option, the mistake
> would have to be at as system level and would be harder to do by accident.
> 

What if somebody logs in as root and does an rm -rf?  I'm not thinking that
running the command to disable checksumming on a file will be something that
gets run often by accident, but even if it does the mantra of linux in general
has never been "dont let users do something because some idiot could screw it
all up."

> If someone were to turn off checksumming and then turn it back on, I
> assume they would lose any continuity of protection that exists if it
> stays on, so it would have to be a major and important decision in an
> existing filesystem.
>

I don't really understand the above objection.  Checksumming doesn't make
everything magically protected, just makes it easier to catch when problems are
happening.  I don't see how having it off then turning it on would cause any
sorts of issues.

Josef