On Thu, Feb 14, 2019 at 02:00:07AM -0800, Omar Sandoval wrote: > From: Omar Sandoval <osandov@xxxxxx> > > Hi, > > Since statx was added in 4.11, userspace has had an interface for > reading btime (file creation time), but no way to set it. This RFC patch > series adds support for changing btime with utimensat(). Patch 1 adds > the VFS infrastructure, patch 2 adds the support to utimensat() with a > new flag, and the rest of the patches add filesystem support; I excluded > CIFS for now because I don't have a CIFS setup to test it on. > > Updating btime is useful for at least a couple of use cases: > > - Backup/restore programs (my motivation for this feature is btrfs send) > - File servers which interoperate with operating systems that allow > updating file creation time, including Mac OS [1] and Windows [2] So you're adding an interface that allows users to change the create time of files without needing any privileges? Inode create time is forensic metadata in XFS - information we use for sequence of event and inode lifetime analysis during examination of broken filesystem images and systems that have been broken into. Just because it's exposed to userspace via statx(), it doesn't mean that it is information that users should be allowed to change. i.e. allowing users to be able to change the create time on files makes it completely useless for the purpose it was added to XFS for... And allowing root to change the create time doesn't really help, because once you've broken into a system, this makes it really easy to cover tracks (e.g. we can't find files that were created and unlinked during the break in window anymore) and lay false trails.... Cheers, Dave. -- Dave Chinner david@xxxxxxxxxxxxx
