Re: Linux ISO-9660 Rock Ridge bug needs fix

[Bodo Eggert]

On Thu, 19 Oct 2006, Joerg Schilling wrote:
> Bodo Eggert <7eggert@xxxxxx> wrote:
> > On Wed, 18 Oct 2006, Joerg Schilling wrote:
> > > Bodo Eggert <7eggert@xxxxxxxxxxxx> wrote:

> > > > BTW2, Just to be cautionous: what will happen if somebody forces the same
> > > > inode number on two different entries?
> >
> > [...]
> > > This is something you cannot check.
> >
> > Exactly that's why I'd ignore the on-disk "inode number" and instead use
> > the generated one untill someone comes along with a clever idea to fix
> > the issue or can show that it's mostly hermless.
> 
> I could understand you in case that Linux would do some basic consistency checks
> in the iso-9660 code already.....

ISO9660-over-NFS is no big usecase, linked files on CD aren't common and 
the current code just won't benefit from hardlinks. Therefore I don't see 
a compelling reason to use this feature without first thinking about 
possible attacks.

Even if there are more holes to be plugged, punching even more holes 
doesn't help. Instead, we should hope that someone finds the time to
plug these holes and praise him when he comes.

> Show me another program besides mkisofs that implements inode numbers _and_ does
> it wrong.

My hacked mkisofs, which I'll use to r00t you all and gain world domination.
-- 
"Don't draw fire; it irritates the people around you."
-Your Buddies
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/