Re: [zfs-discuss] ZFS snapshot versus Netapp - Security and convenience

2010-05-03 Thread Jason King
Well the GUI I think is just Windows, it's all just APIs that are presented to windows. On Mon, May 3, 2010 at 10:16 PM, Edward Ned Harvey wrote: >> From: jason.brian.k...@gmail.com [mailto:jason.brian.k...@gmail.com] On >> Behalf Of Jason King >> >> If you're just wanting to do something like th

Re: [zfs-discuss] ZFS snapshot versus Netapp - Security and convenience

2010-05-03 Thread Edward Ned Harvey
> From: jason.brian.k...@gmail.com [mailto:jason.brian.k...@gmail.com] On > Behalf Of Jason King > > If you're just wanting to do something like the netapp .snapshot > (where it's in every directory), I'd be curious if the CIFS shadow > copy support might already have done a lot of the heavy lifti

Re: [zfs-discuss] ZFS snapshot versus Netapp - Security and convenience

2010-05-03 Thread Edward Ned Harvey
> From: Peter Jeremy [mailto:peter.jer...@alcatel-lucent.com] > > >Therefore, it should be very easy to implement proof of concept, by > writing > >a setuid root C program, similar to "sudo" which could then become > root, > >identify the absolute path of a directory by its inode number, and > the

Re: [zfs-discuss] ZFS snapshot versus Netapp - Security and convenience

2010-05-03 Thread Jason King
If you're just wanting to do something like the netapp .snapshot (where it's in every directory), I'd be curious if the CIFS shadow copy support might already have done a lot of the heavy lifting for this. That might be a good place to look On Mon, May 3, 2010 at 7:25 PM, Peter Jeremy wrote: > On

Re: [zfs-discuss] ZFS snapshot versus Netapp - Security and convenience

2010-05-03 Thread Peter Jeremy
On 2010-Apr-30 21:56:46 +0800, Edward Ned Harvey wrote: >How many bytes long is an inode number? I couldn't find that easily by >googling, so for the moment, I'll guess it's a fixed size, and I'll guess >64bits (8 bytes). Based on a rummage in some header files, it looks like it's 8 bytes. >How

Re: [zfs-discuss] ZFS snapshot versus Netapp - Security and convenience

2010-04-30 Thread Edward Ned Harvey
> From: Peter Jeremy [mailto:peter.jer...@alcatel-lucent.com] > > Whilst it's trivially easy to get from the file to the list of > directories containing that file, actually getting from one directory > to its parent is less so: A directory containing N sub-directories has > N+2 links. Whilst the

Re: [zfs-discuss] ZFS snapshot versus Netapp - Security and convenience

2010-04-30 Thread Edward Ned Harvey
> From: Peter Jeremy [mailto:peter.jer...@alcatel-lucent.com] > > I gather you are suggesting that the inode be extended to contain a > list of the inode numbers of all directories that contain a filename > referring to that inode. Correct. > [inodes] can have up to 32767 links [to them]. Wh

Re: [zfs-discuss] ZFS snapshot versus Netapp - Security and convenience

2010-04-29 Thread Peter Jeremy
On 2010-Apr-30 10:24:14 +0800, Edward Ned Harvey wrote: >Each inode contain a link count. In most cases, each inode has a >link count of 1, but of course that can't be assumed. It seems >trivially simple to me, that along with the link count in each inode, >the filesystem could also store a list

Re: [zfs-discuss] ZFS snapshot versus Netapp - Security and convenience

2010-04-29 Thread Edward Ned Harvey
> From: zfs-discuss-boun...@opensolaris.org [mailto:zfs-discuss- > boun...@opensolaris.org] On Behalf Of Edward Ned Harvey > > Each inode contain a link count.  It seems trivially > simple to me, that along with the link count in each inode, the > filesystem could also store a list of which inodes

[zfs-discuss] ZFS snapshot versus Netapp - Security and convenience

2010-04-29 Thread Edward Ned Harvey
I finally got it, I think. Somebody (with deep and intimate knowledge of ZFS development) please tell me if I've been hitting the crack pipe too hard. But . Part 1 of this email: Netapp snapshot security flaw. Inherent in their implementation of .snapshot directories. Part 2 of this em