Re: [MAINTAINERS/KERNEL SUMMIT] Trust and maintenance of file systems

[Dave Chinner <david@fromorbit.com>]

On Wed, Sep 06, 2023 at 10:51:39PM -0400, Steven Rostedt wrote:
> On Thu, 7 Sep 2023 12:22:43 +1000
> Dave Chinner <david@fromorbit.com> wrote:
> 
> > > Anyway, what about just having read-only be the minimum for supporting a
> > > file system? We can say "sorry, due to no one maintaining this file system,
> > > we will no longer allow write access." But I'm guessing that just
> > > supporting reading an old file system is much easier than modifying one
> > > (wasn't that what we did with NTFS for the longest time?)  
> > 
> > "Read only" doesn't mean the filesytsem implementation is in any way
> > secure, robust or trustworthy - the kernel is still parsing
> > untrusted data in ring 0 using unmaintained, bit-rotted, untested
> > code....
> 
> It's just a way to still easily retrieve it, than going through and looking
> for those old ISOs that still might exist on the interwebs. I wouldn't
> recommend anyone actually having that code enabled on a system that doesn't
> need access to one of those file systems.

In which cae, we should not support it in the kernel!

If all a user needs is a read-only implementation for data recovery,
then it should be done in userspace or with a FUSE back end. Just
because it is a "filesystem" does not mean it needs to be
implemented in the kernel.

> I guess the point I'm making is, what's the burden in keeping it around in
> the read-only state? It shouldn't require any updates for new features,
> which is the complaint I believe Willy was having.

Keeping stuff around as "read-only" doesn't reduce the maintainence
burden; it actually makes it harder because now you can't use the
kernel filesystem code to create the necessary initial conditions
needed to test the filesystem is actually reading things correctly.

That is, testing a "read-only" filesystem implementation requires
you to have some external mechanism to create filesystem images in
the first place. With a read-write implementation, the filesystem
implementation itself can create the structures that then get
tested....

Hence, IMO, gutting a filesystem implementation to just support
read-only behaviour "to prolong it's support life" actually makes
things worse from a maintenance and testing persepective, not
better....

-Dave.
-- 
Dave Chinner
david@fromorbit.com