Implementing fully immutable files

Posted Apr 22, 2019 16:39 UTC (Mon) by wahern (subscriber, #37304)
In reply to: Implementing fully immutable files by epa
Parent article: Implementing fully immutable files

It *is* useful, even with the way it's currently implemented. For example, exploding a tarball--normally you *want* it to be able to overwrite files lacking write permission bits. Such cases are rather niche, but the complexity is negligible so worth it.

I'm sure some people would find the proposed behavior of revoking mmap access useful, too. But the additional complexity is *tremendous* and, IMO, not worth the marginal benefit, even if there are a handful of organizations that *must* have the feature. I mean, if they really need such behavior they can always just terminate all processes with open file handles after making a file immutable. Messy, but at least the mess doesn't become a long-term maintenance burden for everybody else. It's a dubious guarantee, anyhow, considering how easy it will be to accidentally break the invariant.

Implementing fully immutable files

Posted Apr 22, 2019 19:44 UTC (Mon) by wahern (subscriber, #37304) [Link]

Correction: I meant, normally when exploding a tarball you want it to overwrite files without write permission bits because you're replacing the whole tree, but sometimes you don't and setting a file immutable makes the untar operation blow up. It's a fail-safe. There's some cleaning up to do but less than if that critical file was removed.

Implementing fully immutable files

Posted Apr 22, 2019 20:15 UTC (Mon) by rweikusat2 (subscriber, #117920) [Link]

This feature has existed in its present form for at least 18 years, probably more. It even used to be documented incorrectly as

"no data can be written to the file"
(Debian 7 man page)

someone apparently noted that this wasn't accurate and corrected to documentation to

"the file can not be opened in write mode."
(http://man7.org/linux/man-pages/man1/chattr.1.html)

I seriously doubt that there's any organisation on this planet which suddenly "must" have this feature. Methinks this is more something like a bored Oracle guy making undirected changes to a codebase (possibly "a sufficiently well-connected, bored Oracle guy that such undirected changes actually get accepted instead of being stonewalled").