From mboxrd@z Thu Jan  1 00:00:00 1970
From: "John Stoffel" <john@stoffel.org>
Subject: Re: Versioning file system
Date: Thu, 5 Jul 2007 09:57:40 -0400
Message-ID: <18060.63700.223173.537189@stoffel.org>
References: <46731169.2090002@hawkeye.stone.uk.eu.org>
	<467314E2.9010306@zytor.com>
	<Pine.LNX.4.64.0706151547200.27993@blackbox.fnordora.org>
	<20070616145337.GA13391@lazybastard.org>
	<20070618094524.GF5181@schatzie.adilger.int>
	<20070618140143.GD30244@thunk.org>
	<Pine.LNX.4.64.0706180907580.22137@blackbox.fnordora.org>
	<20070618172955.GB24189@thunk.org>
	<20070704173234.GB26201@gateway.home>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Cc: Theodore Tso <tytso@mit.edu>, alan <alan@clueserver.org>,
	J?rn Engel <joern@logfs.org>, "H. Peter Anvin" <hpa@zytor.com>,
	Jack Stone <jack@hawkeye.stone.uk.eu.org>,
	linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
	akpm@linux-foundation.org, viro@zeniv.linux.org.uk
To: Erik Mouw <mouw@nl.linux.org>
Return-path: <linux-fsdevel-owner@vger.kernel.org>
Received: from Mycroft.westnet.com ([216.187.52.7]:37063 "EHLO
	Mycroft.westnet.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1756299AbXGEOCt (ORCPT
	<rfc822;linux-fsdevel@vger.kernel.org>);
	Thu, 5 Jul 2007 10:02:49 -0400
In-Reply-To: <20070704173234.GB26201@gateway.home>
Sender: linux-fsdevel-owner@vger.kernel.org
List-Id: linux-fsdevel.vger.kernel.org

>>>>> "Erik" == Erik Mouw <mouw@nl.linux.org> writes:

Erik> (sorry for the late reply, just got back from holiday)
Erik> On Mon, Jun 18, 2007 at 01:29:56PM -0400, Theodore Tso wrote:
>> As I mentioned in my Linux.conf.au presentation a year and a half ago,
>> the main use of Streams in Windows to date has been for system
>> crackers to hide trojan horse code and rootkits so that system
>> administrators couldn't find them.  :-)

Erik> The only valid use of Streams in Windows I've seen was a virus
Erik> checker that stored a hash of the file in a separate
Erik> stream. Checking a file was a matter of rehashing it and
Erik> comparing against the hash stored in the special hash data
Erik> stream for that particular file.

So what was stopping a virus from infecting a file, re-computing the
hash and pushing the new hash into the stream?  

You need to keep the computed hashes on Read-Only media for true
security, once you let the system change them, then you're toast....

John