Re: [PATCH 1/6] statx: Add a system call to make enhanced file info available

[Jeff Layton]

On Thu, 2016-05-05 at 10:09 +1000, NeilBrown wrote:
> On Thu, May 05 2016, Dave Chinner wrote:
> 
> > 
> > On Fri, Apr 29, 2016 at 01:57:43PM +0100, David Howells wrote:
> > > 
> > > Â(4) File creation time (st_btime*), data version (st_version), inode
> > > ÂÂÂÂÂgeneration number (st_gen).
> > > 
> > > ÂÂÂÂÂThese will be returned if available whether the caller asked for them or
> > > ÂÂÂÂÂnot.ÂÂThe corresponding bits in st_mask will be set or cleared as
> > > ÂÂÂÂÂappropriate to indicate a valid value.
> > IMO, exposing the inode generation number to anyone is a potential
> > security problem because they are used in file handles.
> "security through obscurity".ÂÂWe have Kerberos working really nicely
> for NFS these days.ÂÂDo we still care?
> 
> What if the generation number were only made available to "root"?ÂÂWould
> that allay your concerns?
> Would that still be useful?
> We already have name_to_handle_at().ÂÂExposing the generation number
> could/should follow the same rules at that.ÂÂOr maybe the exposure of
> each field should be guided by the filesystem, depending on (for
> example) whether it is used to provide uniqueness to the filehandle.
> 
> > 
> > 
> > > 
> > > ÂÂÂÂÂIf the caller didn't ask for them, then they may be approximated.ÂÂFor
> > > ÂÂÂÂÂexample, NFS won't waste any time updating them from the server, unless
> > > ÂÂÂÂÂas a byproduct of updating something requested.
> > I would suggest that exposing them from the NFS server is something
> > we most definitely don't want to do because they are the only thing
> > that keeps remote users from guessing filehandles with ease....
> Given that the NFS protocol does not define a "generation number"
> attribute, I think there is no risk for them being exposed from the NFS
> server ... except implicitly within the filehandle of course.
> 
> NeilBrown



I don't see a real attack vector here either, but OTOH is there a
potential user of this at the moment? An earlier chunk of the patch
description says:

(7) Inode generation number: Useful for FUSE and userspace NFS servers
ÂÂÂÂÂ[Bernd Schubert].ÂÂThis was asked for but later deemed unnecessary
ÂÂÂÂÂwith the open-by-handle capability available

...the last bit seems to indicate that we don't really need this
anyway, as most userland servers now work with filehandles from the
kernel.

Maybe leave it out for now? It can always be added later.

-- 
Jeff Layton <jlayton@xxxxxxxxxxxxxxx>