On 07/11/2011 12:33 AM, Ted Ts'o wrote:
On Sun, Jul 10, 2011 at 09:19:58AM +0100, Ric Wheeler wrote:
Just to wrap up this thread, I will throw out some of the use cases
that I have seen....
Unless we clearly articulate what use case we are hoping to address, I
have to admit I'm a little dubious about whether it's worth it to add
"secure delete". There are plenty of other solutions, including
user-space shred, destruction of an encryption key, etc. All of these
solutions have tradeoffs between performance and security.
So if we're going to implement something, we should think very
carefully about what problem we are hoping to solve, and what sort of
adversaries/threat environment where we'd think this would be useful.
I'll observe that in many cases, where you have the sweating Enron
executive trying to destroy evidence, they're going to be thwarted by
automatic backup policies. This is also true BTW if you're worried
about employment records --- and pawing through several terabytes of
backup tapes to delete (only) the employee records for Léo Apotheker
Platner after he resigned from SAG AG would really be unpleasant. :-)
And of course, if you are using devices such as SSD's or
thin-provisioned devices, file-system level erasure may not really do
a lot of your anyway, even if you are using discard.
So --- does anyone have some thoughts about how this would actually
used by potential customers? If not, my vote would be to keep things
as simple as possible, and if it's too complicated, to think carefully
about whether it's worth it to (re)-add this feature.
- Ted
I do think that the synchronous secure delete is useful to have, even if slow.
That said, as you point out, there are lots of ways that this will fail
potentially, including:
* you might have copied a file or had blocks paged out that leave a "ghost" trace
* a simple secure delete that overwrites with zeros is not "sufficient" to erase
tracks for some users (look at the multi-pass options shred does for example)
* ssd's or other devices do wear levelling and move data around internally so
you might be able to rip the device apart and look at the raw flash and recover data
That said, for all normal users, I do think that the zero out is still useful
and reasonable. The simple goal is that once securely deleting, your sys admin
cannot use recovery tools or scan a block device and see your deleted file's
data blocks.
Ric
--
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
