From: Christoph Hellwig <hch@infradead.org>
To: Burn Alting <burn.alting@iinet.net.au>
Cc: audit@vger.kernel.org, linux-security-module@vger.kernel.org,
linux-nfs@vger.kernel.org, linux-fsdevel@vger.kernel.org
Subject: Re: [RFC PATCH v1 1/7] fs: Add inode_get_ino() and implement get_ino() for NFS
Date: Mon, 14 Oct 2024 02:02:17 -0700 [thread overview]
Message-ID: <ZwzeGausiU0IDkFy@infradead.org> (raw)
In-Reply-To: <0e4e7a6d-09e0-480d-baa9-a2e7522a088a@iinet.net.au>
On Mon, Oct 14, 2024 at 07:40:37PM +1100, Burn Alting wrote:
> As someone who lives in the analytical user space of Linux audit, I take it
> that for large (say >200TB) file systems, the inode value reported in audit
> PATH records is no longer forensically defensible and it's use as a
> correlation item is of questionable value now?
What do you mean with forensically defensible?
A 64-bit inode number is supposed to be unique. Some file systems
(most notably btrfs, but probably also various non-native file system)
break and this, and get away with lots of userspace hacks papering
over it. If you are on a 32-bit system and not using the LFS APIs
stat will fail with -EOVERFLOW. Some file systems have options to
never generate > 32bit inode numbers. None of that is directly
related to file system size, although at least for XFS file system
size is one relevant variable, but 200TB is in no way relevant.
next prev parent reply other threads:[~2024-10-14 9:02 UTC|newest]
Thread overview: 79+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-10-10 15:26 [RFC PATCH v1 1/7] fs: Add inode_get_ino() and implement get_ino() for NFS Mickaël Salaün
2024-10-10 15:26 ` [RFC PATCH v1 2/7] audit: Fix inode numbers Mickaël Salaün
2024-10-11 1:20 ` [PATCH RFC " Paul Moore
2024-10-11 1:38 ` Paul Moore
2024-10-11 21:34 ` [RFC PATCH " Paul Moore
2024-10-14 13:30 ` Mickaël Salaün
2024-10-14 23:36 ` Paul Moore
2024-10-10 15:26 ` [RFC PATCH v1 3/7] selinux: Fix inode numbers in error messages Mickaël Salaün
2024-10-11 1:20 ` [PATCH RFC " Paul Moore
2024-10-10 15:26 ` [RFC PATCH v1 4/7] integrity: Fix inode numbers in audit records Mickaël Salaün
2024-10-11 1:20 ` [PATCH RFC " Paul Moore
2024-10-11 10:15 ` Mickaël Salaün
2024-10-11 11:34 ` Roberto Sassu
2024-10-11 12:38 ` Mickaël Salaün
2024-10-11 12:45 ` Roberto Sassu
2024-10-10 15:26 ` [RFC PATCH v1 5/7] ipe: " Mickaël Salaün
2024-10-10 17:44 ` Fan Wu
2024-10-10 15:26 ` [RFC PATCH v1 6/7] smack: Fix inode numbers in logs Mickaël Salaün
2024-10-10 17:18 ` Casey Schaufler
2024-10-10 15:26 ` [RFC PATCH v1 7/7] tomoyo: " Mickaël Salaün
2024-10-12 7:35 ` [PATCH] tomoyo: use u64 for handling numeric values Tetsuo Handa
2024-10-14 13:59 ` Mickaël Salaün
2024-10-10 18:07 ` [RFC PATCH v1 1/7] fs: Add inode_get_ino() and implement get_ino() for NFS Anna Schumaker
2024-10-11 10:14 ` Mickaël Salaün
2024-10-10 19:28 ` Trond Myklebust
2024-10-11 10:15 ` Mickaël Salaün
2024-10-11 12:22 ` Trond Myklebust
2024-10-11 12:38 ` Mickaël Salaün
2024-10-11 12:43 ` Mickaël Salaün
2024-10-11 10:12 ` Tetsuo Handa
2024-10-11 10:54 ` Tetsuo Handa
2024-10-11 11:10 ` Mickaël Salaün
2024-10-11 11:04 ` Mickaël Salaün
2024-10-11 14:27 ` Tetsuo Handa
2024-10-11 15:13 ` Christoph Hellwig
2024-10-11 15:26 ` Mickaël Salaün
2024-10-11 12:30 ` Christoph Hellwig
2024-10-11 12:47 ` Mickaël Salaün
2024-10-11 12:54 ` Christoph Hellwig
2024-10-11 13:20 ` Mickaël Salaün
2024-10-11 13:23 ` Christoph Hellwig
2024-10-11 13:52 ` Mickaël Salaün
2024-10-11 14:39 ` Christoph Hellwig
2024-10-11 15:30 ` Mickaël Salaün
2024-10-11 15:34 ` Christoph Hellwig
2024-10-14 14:35 ` Christian Brauner
2024-10-14 14:36 ` Christoph Hellwig
2024-10-13 10:17 ` Jeff Layton
2024-10-14 8:40 ` Burn Alting
2024-10-14 9:02 ` Christoph Hellwig [this message]
2024-10-14 12:12 ` Burn Alting
2024-10-14 12:17 ` Christoph Hellwig
2024-10-14 13:13 ` Mickaël Salaün
[not found] ` <9c3bc3b7-2e79-4423-b8eb-f9f6249ee5bf@iinet.net.au>
2024-10-14 10:22 ` Jeff Layton
2024-10-14 14:45 ` Christian Brauner
2024-10-14 15:27 ` Mickaël Salaün
2024-10-16 0:15 ` Paul Moore
2024-10-14 14:47 ` Christian Brauner
2024-10-14 17:51 ` Mickaël Salaün
2024-10-16 14:23 ` Christian Brauner
2024-10-16 23:05 ` Paul Moore
2024-10-17 14:30 ` Trond Myklebust
2024-10-17 14:54 ` Paul Moore
2024-10-17 14:58 ` Christoph Hellwig
2024-10-17 15:15 ` Paul Moore
2024-10-17 15:25 ` Christoph Hellwig
2024-10-17 16:43 ` Jan Kara
2024-10-18 5:15 ` Christoph Hellwig
2024-10-21 13:17 ` Christian Brauner
2024-10-17 17:05 ` Jeff Layton
2024-10-17 17:09 ` Trond Myklebust
2024-10-17 17:59 ` Jeff Layton
2024-10-17 21:06 ` Trond Myklebust
2024-10-18 5:18 ` hch
2024-10-17 20:21 ` Paul Moore
2024-10-18 12:25 ` Jan Kara
2024-10-21 13:13 ` Christian Brauner
2024-10-21 14:04 ` Christian Brauner
2024-10-17 14:56 ` Christoph Hellwig
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZwzeGausiU0IDkFy@infradead.org \
--to=hch@infradead.org \
--cc=audit@vger.kernel.org \
--cc=burn.alting@iinet.net.au \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).