Bug 69121 - provide a tool and a mount option to zero out blocks unused by btrfs
Summary: provide a tool and a mount option to zero out blocks unused by btrfs
Status: RESOLVED INVALID
Alias: None
Product: File System
Classification: Unclassified
Component: btrfs (show other bugs)
Hardware: All Linux
: P1 enhancement
Assignee: Josef Bacik
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-01-21 10:57 UTC by Elmar Stellnberger
Modified: 2014-01-21 15:53 UTC (History)
2 users (show)

See Also:
Kernel Version: 3.13
Subsystem:
Regression: No
Bisected commit-id:


Attachments

Description Elmar Stellnberger 2014-01-21 10:57:26 UTC
For reasons of security there should be no additional data on the hard disk which is not used by the proper owners of the machine. One way to achieve this is to zero out all data on the hard disk before usage and to keep deleted files zeroed as well. That way additionally hidden data should be easy to spot. 
  As nowadays the firmware of HDDs has become an attack vector zeroing out may not help on a first glance. However if they want to hide some data by low level mechanisms they will need to allocate some additional space on the hdd which will then not be usable by the operating system. This will usually be done by returning read errors for sectors that store the hidden data and can be undone by a low level format of the drive which is done by some vendor specific tool. Theoretically a modified firmware could compress zeroed out blocks but I doubt that a hdd firmware can be as complex as this as the space for the firmware will be limited. Moreover after flashing a repaired firmware the modified parts of the hard disk should be easy to spot if any non user specific data was zeroed out.
  At last a tool to check whether any space not used by the file system is zeroed and to read out non zeroed parts into file would be required.
Comment 1 Alan 2014-01-21 11:48:51 UTC
This makes little or no sense. Physical drives have more sectors than they show, flash drives are managed in a completely different way, and a trojanned drive could anyway lie and report a smaller capacity in the first place.

The various "trim" invalidation interfaces drives have also don't guarantee the space given back will return zeroes.

Zeroing blocks is a useless exercise, other than in wearing your SSD out faster.  If you don't trust your SSD encrypt on the host.
Comment 2 Elmar Stellnberger 2014-01-21 12:00:21 UTC
Well I thought about traditional hard disks without SSD cash when I wrote about it. Nonetheless I have to consent that there will be no way of gaining full control over a hard disk unless you had an open firmware for it and likely a way to upload the firmware for verification. Up to now there is no such vendor of hdds or is there?
Comment 3 David Sterba 2014-01-21 15:46:09 UTC
I have the code to do the free space zeroing (mentioned on wiki under the respective project idea), but haven't sent it due to lack of the usecases besides the one mentioned above.

Nevertheless, a few weeks ago when the feature was asked about again, somebody said that it would be useful for clearing free space for virtual machine images. This makes sense iff the underlying device does not support TRIM, but qcow2, virtio do, so I still don't see a reason to add the feature.
Comment 4 Elmar Stellnberger 2014-01-21 15:53:51 UTC
I think the request was about sparse file support. You can make such a disk image with unused blocks zeroed out easily a sparse file. I believe that definitely would make sense!

Note You need to log in before you can comment on or make changes to this bug.