| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 17 Oct 2008 15:39:57 +0200 From: Lars Täuber <taeuber@...w.de> To: Theodore Tso <tytso@....edu> Cc: Manish Katiyar <mkatiyar@...il.com>, linux-ext4@...r.kernel.org Subject: Re: undelete still opened file Hi Theodore, Theodore Tso <tytso@....edu> schrieb: > On Fri, Oct 17, 2008 at 02:33:11PM +0200, Lars Täuber wrote: > > Is the space of the file on the underlying block device already > > marked as free? Or does this happen after all processes have closed > > all file descriptors pointing to the file? > > No, the space on the file is not yet marked as free. *However* for > ext3 and ext4, the inode has been placed on the orphaned inode list, > so that if the system crashes, part of the journal recovery process > will at that point free the blocks. not that it is a way I would go, but theoretically: I could provoke a crash and mount the ext3 filesystem as ext2 and restore the file? > > I really want to undo the deletion. (get a link/name connected to > > the root inode of the file again) Is there a way to do this? > > Not currently using ext3/ext4, no. There would have to be an entirely > new system call or other userspace interface for something like this. Is this planned? But a solution should be independent of the real filesystem. Because the file is still somewhere in the ram and represented in linux vfs, isn't it? It only needs to be copied/recreated on to a (different) filesystem somehow. Regards Lars -- To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists