From: Dave Kleikamp <shaggy@linux.vnet.ibm.com>
To: mhalcrow@linux.vnet.ibm.com
Cc: Pavel Machek <pavel@suse.cz>,
Andrew Morton <akpm@linux-foundation.org>,
LKML <linux-kernel@vger.kernel.org>,
Dustin Kirkland <dustin.kirkland@gmail.com>,
Eric Sandeen <sandeen@redhat.com>,
Tyler C Hicks <tchicks@us.ibm.com>,
David Kleikamp <shaggy@us.ibm.com>
Subject: Re: [PATCH 0/5] eCryptfs: Filename Encryption
Date: Thu, 06 Nov 2008 14:52:26 -0600 [thread overview]
Message-ID: <1226004746.8898.6.camel@norville.austin.ibm.com> (raw)
In-Reply-To: <20081106202736.GC6688@halcrowt61p.austin.ibm.com>
On Thu, 2008-11-06 at 14:27 -0600, mhalcrow@linux.vnet.ibm.com wrote:
> On Wed, Nov 05, 2008 at 04:57:54PM +0100, Pavel Machek wrote:
> > On Tue 2008-11-04 15:37:54, Michael Halcrow wrote:
> > > This patchset implements filename encryption via a
> > > passphrase-derived mount-wide Filename Encryption Key (FNEK)
> > > specified as a mount parameter. Each encrypted filename has a
> > > fixed prefix indicating that eCryptfs should try to decrypt the
> > > filename. When eCryptfs encounters
> >
> > That is 'interesting'. What happens if normal filename has that
> > prefix?
>
> If the lower filename has the prefix but does not have a valid tag 70
> packet following the prefix, then eCryptfs will complain in the syslog
> and then pass through the lower filename as-is.
I'd recommend hiding this kind of syslog verbosity behind a debug config
option. I think it would be very easy to create a DOS attack against
ecryptfs by putting all sorts of clever things in the lower file system.
--
David Kleikamp
IBM Linux Technology Center
next prev parent reply other threads:[~2008-11-06 20:53 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-11-04 21:37 Michael Halcrow
2008-11-04 21:39 ` [PATCH 1/5] eCryptfs: Filename Encryption: Tag 70 packets Michael Halcrow
2008-11-06 22:12 ` Andrew Morton
2008-11-12 17:01 ` [PATCH] eCryptfs: Replace %Z with %z Michael Halcrow
2008-11-12 17:04 ` [PATCH] eCryptfs: Fix data types (int/size_t) Michael Halcrow
2008-11-12 17:06 ` [PATCH] eCryptfs: kerneldoc for ecryptfs_parse_tag_70_packet() Michael Halcrow
2008-11-04 21:39 ` [PATCH 2/5] eCryptfs: Filename Encryption: Header updates Michael Halcrow
2008-11-04 21:41 ` [PATCH 3/5] eCryptfs: Filename Encryption: Encoding and encryption functions Michael Halcrow
2008-11-05 18:17 ` Dave Hansen
2008-11-06 21:01 ` Michael Halcrow
2008-11-06 22:12 ` Andrew Morton
2008-11-12 17:11 ` [PATCH] eCryptfs: Clean up ecryptfs_decode_from_filename() Michael Halcrow
2008-11-04 21:42 ` [PATCH 4/5] eCryptfs: Filename Encryption: filldir, lookup, and readlink Michael Halcrow
2008-11-04 21:43 ` [PATCH 5/5] eCryptfs: Filename Encryption: mount option Michael Halcrow
2008-11-06 22:13 ` Andrew Morton
2008-11-14 16:47 ` Michael Halcrow
2008-11-05 15:57 ` [PATCH 0/5] eCryptfs: Filename Encryption Pavel Machek
2008-11-06 20:27 ` Michael Halcrow
2008-11-06 20:52 ` Dave Kleikamp [this message]
2008-11-06 22:11 ` Michael Halcrow
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1226004746.8898.6.camel@norville.austin.ibm.com \
--to=shaggy@linux.vnet.ibm.com \
--cc=akpm@linux-foundation.org \
--cc=dustin.kirkland@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mhalcrow@linux.vnet.ibm.com \
--cc=pavel@suse.cz \
--cc=sandeen@redhat.com \
--cc=shaggy@us.ibm.com \
--cc=tchicks@us.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®