Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #63926 > unrolled thread

Dropping the ntfs kernel module

Back to article view | Back to linux.debian.kernel

Contents

  Dropping the ntfs kernel module Ben Hutchings <ben@decadent.org.uk> - 2019-04-25 16:30 +0200
    Re: Dropping the ntfs kernel module Salvatore Bonaccorso <carnil@debian.org> - 2019-06-08 14:10 +0200
      Re: Dropping the ntfs kernel module "Enrico Weigelt, metux IT consult" <lkml@metux.net> - 2019-06-11 11:40 +0200
        Re: Dropping the ntfs kernel module Ben Hutchings <ben@decadent.org.uk> - 2019-06-11 22:40 +0200

#63926 — Dropping the ntfs kernel module

[Multipart message — attachments visible in raw view] — view raw

Linux's ntfs kernel module, supporting Windows's native filesystem, has
three security issues open against it (CVE-2018-12929, CVE-2018-12930,
CVE-2018-12931) and there is no sign of progress towards fixing them
upstream.

This module is limited to read-only functionality by default; its write
support only covers overwriting existing files and has been disabled in
Debian kernel configurations since stretch.  The alternative FUSE-based 
implementation, ntfs-3g, is far more functional, though it may have
lower performance.  It is already used in the installer and included in
all the desktop tasks (unless installation of Recommends is disabled).

I intend to disable building this module in the next upload to sid,
targetting buster.

I think we should also disable building it in updates to jessie and
stretch, but would like to get an OK from the Stable Release Managers
before doing that.

Ben.

-- 
Ben Hutchings
Horngren's Observation:
              Among economists, the real world is often a special case.

[toc] | [next] | [standalone]

#64230

Hi Stable release managers,

On Thu, Apr 25, 2019 at 03:27:21PM +0100, Ben Hutchings wrote:
> Linux's ntfs kernel module, supporting Windows's native filesystem, has
> three security issues open against it (CVE-2018-12929, CVE-2018-12930,
> CVE-2018-12931) and there is no sign of progress towards fixing them
> upstream.
> 
> This module is limited to read-only functionality by default; its write
> support only covers overwriting existing files and has been disabled in
> Debian kernel configurations since stretch.  The alternative FUSE-based 
> implementation, ntfs-3g, is far more functional, though it may have
> lower performance.  It is already used in the installer and included in
> all the desktop tasks (unless installation of Recommends is disabled).
> 
> I intend to disable building this module in the next upload to sid,
> targetting buster.
> 
> I think we should also disable building it in updates to jessie and
> stretch, but would like to get an OK from the Stable Release Managers
> before doing that.

Any opinion on your side on disabling building the ntfs kernel module
for stretch?

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#64239

On 08.06.19 14:07, Salvatore Bonaccorso wrote:

>> I think we should also disable building it in updates to jessie and
>> stretch, but would like to get an OK from the Stable Release Managers
>> before doing that.
> 
> Any opinion on your side on disabling building the ntfs kernel module
> for stretch?

I don't think it's a good idea if an update suddenly removes some
filesystem - people might realy on it. (dist-upgrade is another story,
here one might be prepared to such things)

--mtx

-- 
Enrico Weigelt, metux IT consult
Free software and Linux embedded engineering
info@metux.net -- +49-151-27565287

[toc] | [prev] | [next] | [standalone]

#64245

[Multipart message — attachments visible in raw view] — view raw

On Tue, 2019-06-11 at 11:34 +0200, Enrico Weigelt, metux IT consult wrote:
> On 08.06.19 14:07, Salvatore Bonaccorso wrote:
> 
> > > I think we should also disable building it in updates to jessie and
> > > stretch, but would like to get an OK from the Stable Release Managers
> > > before doing that.
> > 
> > Any opinion on your side on disabling building the ntfs kernel module
> > for stretch?
> 
> I don't think it's a good idea if an update suddenly removes some
> filesystem - people might realy on it. (dist-upgrade is another story,
> here one might be prepared to such things)

I very much doubt that people do depend on it, because it has never
been very useful and there is a better alternative that gets used by
default.

Ben.

-- 
Ben Hutchings
For every complex problem
there is a solution that is simple, neat, and wrong.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web