From: Theodore Tso <tytso@mit.edu>
To: "Jörn Engel" <joern@logfs.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>, alan <alan@clueserver.org>,
Bodo Eggert <7eggert@gmx.de>,
Jack Stone <jack@hawkeye.stone.uk.eu.org>,
linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
akpm@linux-foundation.org, viro@zeniv.linux.org.uk
Subject: Re: Versioning file system
Date: Tue, 19 Jun 2007 03:01:21 -0400 [thread overview]
Message-ID: <20070619070121.GA9177@thunk.org> (raw)
In-Reply-To: <20070618222656.GB25089@lazybastard.org>
On Tue, Jun 19, 2007 at 12:26:57AM +0200, Jörn Engel wrote:
> The main difference appears to be the potential size. Both extended
> attributes and forks allow for extra data that I neither want or need.
> But once the extra space is large enough to hide a rootkit in, it
> becomes a security problem instead of just something pointless.
The other difference is that you can't execute an extended attribute.
You can store kvm/qemu, a complete virtualization enviroment, shared
libraries, and other executables all inside a forks inside a file, and
then execute programs/rootkit out of said file fork(s).
As I mentioned in my LCA presentation, one system administrator
refused to upgrade beyond Solaris 8 because he thought forks were good
for nothing but letting system crackers hide rootkits that wouldn't be
detected by programs like tripwire. The question then is why in the
world would we want to replicate Sun's mistakes?
- Ted
-
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2007-06-19 7:02 UTC|newest]
Thread overview: 106+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <8wst3-3kh-31@gated-at.bofh.it>
[not found] ` <8wsCC-3wf-21@gated-at.bofh.it>
[not found] ` <8wsW4-3UY-3@gated-at.bofh.it>
[not found] ` <8wJal-3KA-1@gated-at.bofh.it>
[not found] ` <8xm22-4Ql-1@gated-at.bofh.it>
[not found] ` <8xq5G-32l-7@gated-at.bofh.it>
[not found] ` <8xs7w-69W-21@gated-at.bofh.it>
2007-06-18 20:54 ` Versioning file system Bodo Eggert
2007-06-18 21:08 ` alan
2007-06-18 21:31 ` H. Peter Anvin
2007-06-18 21:34 ` Jeremy Allison
2007-06-18 22:10 ` Theodore Tso
2007-06-18 22:26 ` Jörn Engel
2007-06-18 21:24 ` Brad Boyer
2007-06-19 3:15 ` Kyle Moffett
2007-06-18 22:34 ` Jeremy Allison
2007-06-18 22:56 ` alan
2007-06-19 7:01 ` Theodore Tso [this message]
2007-06-18 22:48 ` Jeremy Allison
2007-06-18 23:00 ` alan
2007-06-19 7:05 ` Theodore Tso
2007-06-19 16:52 ` Jeremy Allison
2007-06-19 16:56 ` H. Peter Anvin
2007-06-18 22:47 ` alan
2007-06-15 22:23 Jack Stone
2007-06-15 22:38 ` H. Peter Anvin
2007-06-15 22:51 ` alan
2007-06-15 22:59 ` H. Peter Anvin
2007-06-15 23:06 ` alan
2007-06-16 8:11 ` Jack Stone
2007-06-16 9:46 ` Jeffrey V. Merkey
2007-06-16 10:12 ` Jeffrey V. Merkey
2007-06-16 13:15 ` Mark Williamson
2007-06-16 19:57 ` Jeffrey V. Merkey
2007-06-16 16:49 ` Jan Harkes
2007-06-16 20:03 ` Jeffrey V. Merkey
2007-06-16 19:38 ` Jack Stone
2007-06-16 20:08 ` Alan Cox
2007-06-16 21:25 ` Jeffrey V. Merkey
2007-06-16 20:39 ` Jan Harkes
2007-06-16 20:43 ` Jack Stone
2007-06-16 22:17 ` Alan Cox
2007-06-17 2:18 ` Jeffrey V. Merkey
2007-06-17 2:39 ` Jeffrey V. Merkey
2007-06-17 22:11 ` Dale Amon
2007-06-16 21:06 ` Dale Amon
2007-06-16 14:53 ` Jörn Engel
2007-06-18 9:45 ` Andreas Dilger
2007-06-18 9:54 ` Jack Stone
2007-06-18 10:13 ` Jörn Engel
2007-06-18 14:01 ` Theodore Tso
2007-06-18 16:16 ` alan
2007-06-18 17:29 ` Theodore Tso
2007-06-18 17:33 ` Jeremy Allison
2007-06-18 20:30 ` Theodore Tso
2007-06-18 20:50 ` J. Bruce Fields
2007-06-18 17:46 ` H. Peter Anvin
2007-07-04 17:32 ` Erik Mouw
2007-07-04 20:47 ` Theodore Tso
2007-07-05 17:55 ` Erik Mouw
2007-07-05 13:57 ` John Stoffel
2007-07-05 14:23 ` Chris Mason
2007-07-05 17:57 ` Erik Mouw
2007-06-18 15:32 ` Chris Mason
2007-06-18 23:18 ` Bron Gondwana
2007-09-29 17:44 ` Sorin Faibish
2007-06-18 15:51 ` Bryan Henderson
2007-06-18 16:37 ` Jack Stone
2007-06-18 16:56 ` H. Peter Anvin
2007-06-18 17:56 ` Bryan Henderson
2007-06-19 3:10 ` Kyle Moffett
2007-06-19 7:49 ` Jack Stone
2007-06-19 7:58 ` Bron Gondwana
2007-06-20 2:43 ` Kyle Moffett
2007-06-19 9:09 ` Martin Langhoff
2007-06-19 16:52 ` Jakub Narebski
2007-06-15 22:52 ` Chris Snook
2007-06-16 8:25 ` Jack Stone
2007-06-19 18:03 ` Chris Snook
2007-06-19 19:06 ` Jack Stone
2007-06-19 20:03 ` Chris Snook
2007-06-19 20:08 ` Jack Stone
2007-06-19 20:15 ` Chris Snook
2007-06-19 20:27 ` Jack Stone
2007-06-19 20:34 ` John Stoffel
2007-06-19 20:38 ` Jack Stone
2007-06-19 20:38 ` Matthew Wilcox
2007-06-19 21:02 ` John Stoffel
2007-06-19 19:08 ` H. Peter Anvin
2007-06-19 19:12 ` Jack Stone
2007-06-19 19:15 ` H. Peter Anvin
2007-06-19 19:22 ` Jack Stone
2007-06-19 20:10 ` Chris Snook
2007-06-19 20:14 ` Jack Stone
2007-06-19 20:31 ` Chris Snook
2007-06-20 8:34 ` Bernd Petrovitsch
2007-06-19 21:50 ` Alan Cox
2007-06-19 22:07 ` H. Peter Anvin
2007-06-20 8:05 ` Ph. Marek
2007-06-19 20:43 ` Lennart Sorensen
2007-06-19 22:07 ` david
2007-06-19 22:13 ` H. Peter Anvin
2007-06-19 23:07 ` Jan Harkes
2007-06-19 23:12 ` H. Peter Anvin
2007-06-19 22:21 ` Lennart Sorensen
2007-06-19 23:35 ` Bryan Henderson
2007-06-20 0:27 ` Trond Myklebust
2007-06-20 5:00 ` H. Peter Anvin
2007-06-20 17:04 ` Bryan Henderson
2007-06-20 17:10 ` H. Peter Anvin
2007-06-20 17:33 ` Chris Snook
2007-06-15 22:57 ` Kok, Auke
2007-06-15 23:01 ` alan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20070619070121.GA9177@thunk.org \
--to=tytso@mit.edu \
--cc=7eggert@gmx.de \
--cc=akpm@linux-foundation.org \
--cc=alan@clueserver.org \
--cc=hpa@zytor.com \
--cc=jack@hawkeye.stone.uk.eu.org \
--cc=joern@logfs.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).