From owner-freebsd-geom@FreeBSD.ORG Sun Jun 9 18:24:57 2013 Return-Path: Delivered-To: freebsd-geom@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 65F59AA3 for ; Sun, 9 Jun 2013 18:24:57 +0000 (UTC) (envelope-from pawel@dawidek.net) Received: from mail.dawidek.net (garage.dawidek.net [91.121.88.72]) by mx1.freebsd.org (Postfix) with ESMTP id 32A2C1899 for ; Sun, 9 Jun 2013 18:24:56 +0000 (UTC) Received: from localhost (89-73-195-149.dynamic.chello.pl [89.73.195.149]) by mail.dawidek.net (Postfix) with ESMTPSA id 31B80E47; Sun, 9 Jun 2013 20:20:34 +0200 (CEST) Date: Sun, 9 Jun 2013 20:24:57 +0200 From: Pawel Jakub Dawidek To: Andrew Romero Subject: Re: geli external header (metadata) Message-ID: <20130609182457.GB2468@garage.freebsd.pl> References: <51B31D42.2010801@gmail.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="St7VIuEGZ6dlpu13" Content-Disposition: inline In-Reply-To: <51B31D42.2010801@gmail.com> X-OS: FreeBSD 10.0-CURRENT amd64 User-Agent: Mutt/1.5.21 (2010-09-15) Cc: freebsd-geom@freebsd.org X-BeenThere: freebsd-geom@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: GEOM-specific discussions and implementations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Jun 2013 18:24:57 -0000 --St7VIuEGZ6dlpu13 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Jun 08, 2013 at 03:02:10PM +0300, Andrew Romero wrote: > Hi all > I made a patch to support of external header (metadata) on GEOM ELI (geli) >=20 > System: FreeBSD 9-STABLE r250964 i386 >=20 > geli patch - http://pastebin.com/UGpnMN19 > regresion patch - http://pastebin.com/hJVkTpJZ I don't mean to discourage you, but every additional complexity comes at risk and it case of GELI this is security risk. What is missing in your work is explanation how it that useful for the users? How do you use it? First I need to understand and be convinced that this functionality is generally useful and thus is worth additional complexity and risk. --=20 Pawel Jakub Dawidek http://www.wheelsystems.com FreeBSD committer http://www.FreeBSD.org Am I Evil? Yes, I Am! http://mobter.com --St7VIuEGZ6dlpu13 Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.20 (FreeBSD) iEYEARECAAYFAlG0yHkACgkQForvXbEpPzTsUACfcvdOnjELygfbVTc7Rb3kC+Kl rwwAn2/R0tJEjfBVDn804mIFnXlBZVqo =0r5s -----END PGP SIGNATURE----- --St7VIuEGZ6dlpu13-- From owner-freebsd-geom@FreeBSD.ORG Sun Jun 9 19:51:45 2013 Return-Path: Delivered-To: freebsd-geom@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id EB672E35; Sun, 9 Jun 2013 19:51:45 +0000 (UTC) (envelope-from gcr+freebsd-geom@tharned.org) Received: from roadkill.tharned.org (roadkill.tharned.org [75.145.12.185]) by mx1.freebsd.org (Postfix) with ESMTP id B1E2F1E16; Sun, 9 Jun 2013 19:51:45 +0000 (UTC) Received: from badger.tharned.org (badger.tharned.org [10.10.10.23]) (authenticated bits=0) by roadkill.tharned.org (8.14.7/8.14.7) with ESMTP id r59JpCRj030341 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sun, 9 Jun 2013 14:51:39 -0500 (CDT) (envelope-from gcr+freebsd-geom@tharned.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tharned.org; s=2013; t=1370807499; bh=slijGhmHof7EB/JQlb7LwVUNhnfadwzwyGO3lcelXZE=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=Lu5jQDGnlpl1nZ05akUyK+Jt6FEz5M0Tv9xeHvxb91uc6MLxDqkCWRTAIiGN0t4co QtduiHIUsQ1vwvY+hxDV310gCT7MGBsw2YgNR67AB75rx5Z9L5rA2cylVRA+eqdB0i 8y8EFunrQjC/yFWMKkE6R+snMZ1EYd+MPhHthCHg= Date: Sun, 9 Jun 2013 14:51:12 -0500 (CDT) From: Greg Rivers To: Pawel Jakub Dawidek Subject: Re: geli external header (metadata) In-Reply-To: <20130609182457.GB2468@garage.freebsd.pl> Message-ID: References: <51B31D42.2010801@gmail.com> <20130609182457.GB2468@garage.freebsd.pl> User-Agent: Alpine 2.00 (BSF 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.4.3 (roadkill.tharned.org [75.145.12.185]); Sun, 09 Jun 2013 14:51:39 -0500 (CDT) Cc: Andrew Romero , freebsd-geom@freebsd.org X-BeenThere: freebsd-geom@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: GEOM-specific discussions and implementations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Jun 2013 19:51:46 -0000 On Sun, 9 Jun 2013, Pawel Jakub Dawidek wrote: > On Sat, Jun 08, 2013 at 03:02:10PM +0300, Andrew Romero wrote: > > Hi all > > I made a patch to support of external header (metadata) on GEOM ELI (geli) > > > > System: FreeBSD 9-STABLE r250964 i386 > > > > geli patch - http://pastebin.com/UGpnMN19 > > regresion patch - http://pastebin.com/hJVkTpJZ > > I don't mean to discourage you, but every additional complexity comes at > risk and it case of GELI this is security risk. What is missing in your > work is explanation how it that useful for the users? How do you use it? > First I need to understand and be convinced that this functionality is > generally useful and thus is worth additional complexity and risk. > I can't speak for Mr Romero, but I imagine what he's after is plausible deniability. The GELI metadata on a volume unambiguously declares it to be encrypted data. Properly implemented, I think this could be a worthwhile enhancement for certain applications or circumstances where one may not wish to invite further scrutiny. -- Greg Rivers From owner-freebsd-geom@FreeBSD.ORG Sun Jun 9 20:12:56 2013 Return-Path: Delivered-To: freebsd-geom@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id D52384AE for ; Sun, 9 Jun 2013 20:12:56 +0000 (UTC) (envelope-from pawel@dawidek.net) Received: from mail.dawidek.net (garage.dawidek.net [91.121.88.72]) by mx1.freebsd.org (Postfix) with ESMTP id 9FFFA1F7C for ; Sun, 9 Jun 2013 20:12:56 +0000 (UTC) Received: from localhost (89-73-195-149.dynamic.chello.pl [89.73.195.149]) by mail.dawidek.net (Postfix) with ESMTPSA id 1BBC4EA5; Sun, 9 Jun 2013 22:08:34 +0200 (CEST) Date: Sun, 9 Jun 2013 22:12:57 +0200 From: Pawel Jakub Dawidek To: Greg Rivers Subject: Re: geli external header (metadata) Message-ID: <20130609201257.GC2468@garage.freebsd.pl> References: <51B31D42.2010801@gmail.com> <20130609182457.GB2468@garage.freebsd.pl> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="qtZFehHsKgwS5rPz" Content-Disposition: inline In-Reply-To: X-OS: FreeBSD 10.0-CURRENT amd64 User-Agent: Mutt/1.5.21 (2010-09-15) Cc: Andrew Romero , freebsd-geom@freebsd.org X-BeenThere: freebsd-geom@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: GEOM-specific discussions and implementations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Jun 2013 20:12:56 -0000 --qtZFehHsKgwS5rPz Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Jun 09, 2013 at 02:51:12PM -0500, Greg Rivers wrote: > On Sun, 9 Jun 2013, Pawel Jakub Dawidek wrote: >=20 > > On Sat, Jun 08, 2013 at 03:02:10PM +0300, Andrew Romero wrote: > > > Hi all > > > I made a patch to support of external header (metadata) on GEOM ELI (= geli) > > >=20 > > > System: FreeBSD 9-STABLE r250964 i386 > > >=20 > > > geli patch - http://pastebin.com/UGpnMN19 > > > regresion patch - http://pastebin.com/hJVkTpJZ > >=20 > > I don't mean to discourage you, but every additional complexity comes a= t=20 > > risk and it case of GELI this is security risk. What is missing in your= =20 > > work is explanation how it that useful for the users? How do you use it= ?=20 > > First I need to understand and be convinced that this functionality is= =20 > > generally useful and thus is worth additional complexity and risk. > > >=20 > I can't speak for Mr Romero, but I imagine what he's after is plausible= =20 > deniability. The GELI metadata on a volume unambiguously declares it to= =20 > be encrypted data. >=20 > Properly implemented, I think this could be a worthwhile enhancement for= =20 > certain applications or circumstances where one may not wish to invite=20 > further scrutiny. That was my first guest too, but in that case I'd much prefer to have this implemented without the need of storing metadata outside. I even started implementing it some time ago, but run out of time before it was done and dropped it. To ensure plausible deniability using proposed change one has to store metadata on removable device (like USB stick) and always remember to remove it once GELI provider is attached. This requirement can be avoided and avoiding it would significantly extend number of potential users. --=20 Pawel Jakub Dawidek http://www.wheelsystems.com FreeBSD committer http://www.FreeBSD.org Am I Evil? Yes, I Am! http://mobter.com --qtZFehHsKgwS5rPz Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.20 (FreeBSD) iEYEARECAAYFAlG04ckACgkQForvXbEpPzQa3ACeJcsNTDhnqwui7dNcxUgZkUIf tiMAn38Ie9A9W+fEoFEkVxQCs0VAdCBr =T5KK -----END PGP SIGNATURE----- --qtZFehHsKgwS5rPz-- From owner-freebsd-geom@FreeBSD.ORG Mon Jun 10 11:06:48 2013 Return-Path: Delivered-To: freebsd-geom@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id 516B1FD6 for ; Mon, 10 Jun 2013 11:06:48 +0000 (UTC) (envelope-from owner-bugmaster@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) by mx1.freebsd.org (Postfix) with ESMTP id 33FD01C82 for ; Mon, 10 Jun 2013 11:06:48 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.7/8.14.7) with ESMTP id r5AB6mDE096947 for ; Mon, 10 Jun 2013 11:06:48 GMT (envelope-from owner-bugmaster@FreeBSD.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.7/8.14.7/Submit) id r5AB6l7b096945 for freebsd-geom@FreeBSD.org; Mon, 10 Jun 2013 11:06:47 GMT (envelope-from owner-bugmaster@FreeBSD.org) Date: Mon, 10 Jun 2013 11:06:47 GMT Message-Id: <201306101106.r5AB6l7b096945@freefall.freebsd.org> X-Authentication-Warning: freefall.freebsd.org: gnats set sender to owner-bugmaster@FreeBSD.org using -f From: FreeBSD bugmaster To: freebsd-geom@FreeBSD.org Subject: Current problem reports assigned to freebsd-geom@FreeBSD.org X-BeenThere: freebsd-geom@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: GEOM-specific discussions and implementations List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Jun 2013 11:06:48 -0000 Note: to view an individual PR, use: http://www.freebsd.org/cgi/query-pr.cgi?pr=(number). The following is a listing of current problems submitted by FreeBSD users. These represent problem reports covering all versions including experimental development code and obsolete releases. S Tracker Resp. Description -------------------------------------------------------------------------------- o kern/178684 geom gpart(8) cannot get my GEOM tree o kern/178359 geom [geom] [patch] geom_eli: support external metadata o kern/176744 geom [geom] [patch] BIO_FLUSH not recorded by devstats o kern/170038 geom [geom] geom_mirror always starts degraded after reboot o kern/169539 geom [geom] [patch] fix ability to run gmirror on MSI MegaR a bin/169077 geom bsdinstall(8) does not use partition labels in /etc/fs f kern/165745 geom [geom] geom_multipath page fault on removed drive o kern/165428 geom [glabel][patch] Add xfs support to glabel o kern/164254 geom [geom] gjournal not stopping on GPT partitions o kern/164252 geom [geom] gjournal overflow o kern/164143 geom [geom] Partition table not recognized after upgrade R8 a kern/163020 geom [geli] [patch] enable the Camellia-XTS on GEOM ELI o kern/162690 geom [geom] gpart label changes only take effect after a re o kern/162010 geom [geli] panic: Provider's error should be set (error=0) o kern/161979 geom [geom] glabel doesn't update after newfs, and glabel s o kern/161752 geom [geom] glabel(8) doesn't get gpt label change o bin/161677 geom gpart(8) Probably bug in gptboot o kern/160409 geom [geli] failed to attach provider f kern/159595 geom [geom] [panic] panic on gmirror unload in vbox [regres f kern/159414 geom [isp] isp(4)+gmultipath(8) : removing active fiber pat p kern/158398 geom [headers] [patch] includes o kern/158197 geom [geom] geom_cache with size>1000 leads to panics o kern/157879 geom [libgeom] [regression] ABI change without version bump o kern/157863 geom [geli] kbdmux prevents geli passwords from being enter o kern/157739 geom [geom] GPT labels with geom_multipath o kern/157724 geom [geom] gpart(8) 'add' command must preserve gap for sc o kern/157723 geom [geom] GEOM should not process 'c' (raw) partitions fo o kern/157108 geom [gjournal] dumpon(8) fails on gjournal providers o kern/155994 geom [geom] Long "Suspend time" when reading large files fr o kern/154226 geom [geom] GEOM label does not change when you modify them o kern/150858 geom [geom] [geom_label] [patch] glabel(8) is not compatibl o kern/150626 geom [geom] [gjournal] gjournal(8) destroys label o kern/150555 geom [geom] gjournal unusable on GPT partitions o kern/150334 geom [geom] [udf] [patch] geom label does not support UDF o kern/149762 geom volume labels with rogue characters o bin/149215 geom [panic] [geom_part] gpart(8): Delete linux's slice via o kern/147667 geom [gmirror] Booting with one component of a gmirror, the o kern/145818 geom [geom] geom_stat_open showing cached information for n o kern/145042 geom [geom] System stops booting after printing message "GE o kern/143455 geom gstripe(8) in RELENG_8 (31st Jan 2010) broken o kern/142563 geom [geom] [hang] ioctl freeze in zpool o kern/141740 geom [geom] gjournal(8): g_journal_destroy concurrent error o kern/140352 geom [geom] gjournal + glabel not working o kern/135898 geom [geom] Severe filesystem corruption - large files or l o kern/134113 geom [geli] Problem setting secondary GELI key o kern/133931 geom [geli] [request] intentionally wrong password to destr o bin/132845 geom [geom] [patch] ggated(8) does not close files opened a o bin/131415 geom [geli] keystrokes are unregulary sent to Geli when typ o kern/131353 geom [geom] gjournal(8) kernel lock o kern/129674 geom [geom] gjournal root did not mount on boot o kern/129645 geom gjournal(8): GEOM_JOURNAL causes system to fail to boo o kern/129245 geom [geom] gcache is more suitable for suffix based provid o kern/127420 geom [geom] [gjournal] [panic] Journal overflow on gmirrore o kern/124973 geom [gjournal] [patch] boot order affects geom_journal con o kern/124969 geom gvinum(8): gvinum raid5 plex does not detect missing s o kern/123962 geom [panic] [gjournal] gjournal (455Gb data, 8Gb journal), o kern/123122 geom [geom] GEOM / gjournal kernel lock o kern/122738 geom [geom] gmirror list "losts consumers" after gmirror de o kern/122067 geom [geom] [panic] Geom crashed during boot o kern/121364 geom [gmirror] Removing all providers create a "zombie" mir o kern/120091 geom [geom] [geli] [gjournal] geli does not prompt for pass o kern/115856 geom [geli] ZFS thought it was degraded when it should have o kern/115547 geom [geom] [patch] [request] let GEOM Eli get password fro o kern/113837 geom [geom] unable to access 1024 sector size storage o kern/113419 geom [geom] geom fox multipathing not failing back o kern/107707 geom [geom] [patch] [request] add new class geom_xbox360 to o kern/94632 geom [geom] Kernel output resets input while GELI asks for o kern/90582 geom [geom] [panic] Restore cause panic string (ffs_blkfree o bin/90093 geom fdisk(8) incapable of altering in-core geometry o kern/87544 geom [gbde] mmaping large files on a gbde filesystem deadlo o bin/86388 geom [geom] [geom_part] periodic(8) daily should backup gpa o kern/84556 geom [geom] [panic] GBDE-encrypted swap causes panic at shu o kern/79251 geom [2TB] newfs fails on 2.6TB gbde device o kern/79035 geom [vinum] gvinum unable to create a striped set of mirro o bin/78131 geom gbde(8) "destroy" not working. 75 problems total.