2009/4/7 Alex Zhuravlev <span dir="ltr"><<a href="mailto:bzzz@sun.com">bzzz@sun.com</a>></span><br><div class="gmail_quote"><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
>>>>> Andreas Dilger (AD) writes:</blockquote><div><br>Hello,<br><br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br>
<div class="im"><br>
AD> On Apr 06, 2009 13:23 +0300, Alexander Zarochentsev wrote:<br>
>> On 1 April 2009 12:17:17 Eric Barton wrote:<br>
>> I think we can't avoid tagging OST object creation w/ epoch counter.<br>
>> Would Lustre users complain if file writes are out-of-epochs?<br>
>><br>
>> There is a security problem with out-of-epochs writes and setting<br>
>> file attributes (especially permissions):<br>
>> chmod 400 foo; cat /etc/secret-file >> foo. Chmod/chown can be a special<br>
>> case which triggers wbc flush.<br>
<br>
</div>AD> While this example has been given many times as a security issue that<br>
AD> forces many strange actions on the part of Lustre, the example is<br>
AD> fundamentally broken because POSIX allows "foo" to be opened before the<br>
AD> chmod, and kept open until after the write and then read the "secret-file"<br>
AD> content. The "foo" file needs to be created securely in the first place<br>
AD> to be safe.</blockquote><div><br>the original "partial write-back" problem was demonstrated with the use case<br><br>$ mkdir -m 0700 a # nobody but me can access things under "a"<br>$ umask 000<br>
$ mkdir -m 0777 -p a/b/c/d <br>$ echo "secret data" > a/b/c/d/file<br>$ sync # time passes...<br>$ echo > a/b/c/d/file # truncate secret data<br>$ chmod 777 a # relax permissions<br><br>Note that here an ordering between data and meta-data updates on _different_ objects is important.<br>
<br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br>
<br>
yup, and there is no way in posix to even check whether file is opened.<br>
<br>
my take on this and similar security related issues is that we probably<br>
should provide two modes:<br>
1) strict, when no optimizations in order of flush is done<br>
2) relaxed, when order is not garanteed and user should use some form of sync<br>
but lustre can improve performance</blockquote><div><br>The old (and outdated) WBC HLD has a section "Partial write-out" describing these issues.<br><br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<font color="#888888">
--<br>
thanks, Alex</font></blockquote><div><br>Nikita.<br></div></div><br>