Did you know that the ext4 filesystem has the option for case-insensitive
file/directory names?

First of all, ensure your kernel was built with the “CONFIG_UNICODE=y”
option. Then, you have to enable this option at filesystem creation time,
by specifying an “encoding” setting, e.g.

mkfs -t ext4 -E encoding=utf8 «block-device»

Next, you mount the volume as normal, but there is no difference in
behaviour--yet. You must enable case-insensitivity on the directories on
that volume where you want it (before putting anything in those
directories):

chattr +F «dirname»

This attribute is propagated by default when subdirectories are created in
that directory, so if you want to enable it for the whole volume, you can
set it on the root directory of the volume while it is still empty.

On 2024-02-08 02:48, Lawrence D'Oliveiro wrote:
> Did you know that the ext4 filesystem has the option for case-insensitive
> file/directory names?
>
> First of all, ensure your kernel was built with the “CONFIG_UNICODE=y”
> option. Then, you have to enable this option at filesystem creation time,
> by specifying an “encoding” setting, e.g.
>
> mkfs -t ext4 -E encoding=utf8 «block-device»
>
> Next, you mount the volume as normal, but there is no difference in
> behaviour--yet. You must enable case-insensitivity on the directories on
> that volume where you want it (before putting anything in those
> directories):
>
> chattr +F «dirname»
>
> This attribute is propagated by default when subdirectories are created in
> that directory, so if you want to enable it for the whole volume, you can
> set it on the root directory of the volume while it is still empty.

Be careful, this is dangerous.

--
Cheers, Carlos.

On Thu, 8 Feb 2024 04:28:13 +0100, Carlos E.R. wrote:

> On 2024-02-08 02:48, Lawrence D'Oliveiro wrote:
>
>> Did you know that the ext4 filesystem has the option for
>> case-insensitive file/directory names?
>
> Be careful, this is dangerous.

Why?

On 2/7/24 21:57, Lawrence D'Oliveiro wrote:
> On Thu, 8 Feb 2024 04:28:13 +0100, Carlos E.R. wrote:
>
>> On 2024-02-08 02:48, Lawrence D'Oliveiro wrote:
>>
>>> Did you know that the ext4 filesystem has the option for
>>> case-insensitive file/directory names?
>>
>> Be careful, this is dangerous.
>
> Why?
It's a fundamental paradigm change that goes against one of the things
that is related to security.

E.g. PATH=/usr/local/bin:/usr/bin:/bin

Which executable is run first when you type `su`?

- /usr/local/bin/SU
- /usr/bin/sU
- /bin/su

By changing how the system interprets case, you inadvertently break
fundamental assumptions that the system makes.

--
Grant. . . .

On Wed, 7 Feb 2024 22:59:35 -0600, Grant Taylor wrote:

> Which executable is run first when you type `su`?
>
> - /usr/local/bin/SU
> - /usr/bin/sU
> - /bin/su

The first one that matches, same as now.

On 08/02/2024 03:28, Carlos E.R. wrote:
> On 2024-02-08 02:48, Lawrence D'Oliveiro wrote:
>> Did you know that the ext4 filesystem has the option for case-insensitive
>> file/directory names?
>>
>> First of all, ensure your kernel was built with the “CONFIG_UNICODE=y”
>> option. Then, you have to enable this option at filesystem creation time,
>> by specifying an “encoding” setting, e.g.
>>
>>      mkfs -t ext4 -E encoding=utf8 «block-device»
>>
>> Next, you mount the volume as normal, but there is no difference in
>> behaviour--yet. You must enable case-insensitivity on the directories on
>> that volume where you want it (before putting anything in those
>> directories):
>>
>>      chattr +F «dirname»
>>
>> This attribute is propagated by default when subdirectories are
>> created in
>> that directory, so if you want to enable it for the whole volume, you can
>> set it on the root directory of the volume while it is still empty.
>
> Be careful, this is dangerous.
>
>
Tell me about it

I once mistakenly added a case sensitive disk to an Apple OS/X machine.
Applications promptly stopped working.

Using 'strings' on the source code revealed that *the same files* were
randomly being accessed in upper case, lower case and a mixture of both!

--
The theory of Communism may be summed up in one sentence: Abolish all
private property.

Karl Marx

On 08/02/2024 04:59, Grant Taylor wrote:
> On 2/7/24 21:57, Lawrence D'Oliveiro wrote:
>> On Thu, 8 Feb 2024 04:28:13 +0100, Carlos E.R. wrote:
>>
>>> On 2024-02-08 02:48, Lawrence D'Oliveiro wrote:
>>>
>>>> Did you know that the ext4 filesystem has the option for
>>>> case-insensitive file/directory names?
>>>
>>> Be careful, this is dangerous.
>>
>> Why?
> It's a fundamental paradigm change that goes against one of the things
> that is related to security.
>
> E.g.  PATH=/usr/local/bin:/usr/bin:/bin
>
> Which executable is run first when you type `su`?
>
>  - /usr/local/bin/SU
>  - /usr/bin/sU
>  - /bin/su
>
> By changing how the system interprets case, you inadvertently break
> fundamental assumptions that the system makes.
>
>
>
+1001

--
No Apple devices were knowingly used in the preparation of this post.

Grant Taylor <gtaylor@tnetconsulting.net> writes:
> On 2/7/24 21:57, Lawrence D'Oliveiro wrote:
>> On Thu, 8 Feb 2024 04:28:13 +0100, Carlos E.R. wrote:
>>> On 2024-02-08 02:48, Lawrence D'Oliveiro wrote:
>>>> Did you know that the ext4 filesystem has the option for
>>>> case-insensitive file/directory names?
>>>
>>> Be careful, this is dangerous.
>> Why?
> It's a fundamental paradigm change that goes against one of the things
> that is related to security.
>
> E.g. PATH=/usr/local/bin:/usr/bin:/bin
>
> Which executable is run first when you type `su`?
>
> - /usr/local/bin/SU
> - /usr/bin/sU
> - /bin/su

What’s the threat model here?

If an attacker can put a hostile command sU in /usr/bin, they must have
been able to write /usr/bin, in which case they could just replace
/usr/bin/su with their own version. They don’t need a case-insensitive
filesystem to do that.

If a legitimate administrator has created /usr/bin/sU, with different
behavior to /usr/bin/su, they’re only attacking themselves.

--
https://www.greenend.org.uk/rjk/

Lawrence D'Oliveiro <ldo@nz.invalid> writes:
> On Thu, 8 Feb 2024 04:28:13 +0100, Carlos E.R. wrote:
>> On 2024-02-08 02:48, Lawrence D'Oliveiro wrote:
>>> Did you know that the ext4 filesystem has the option for
>>> case-insensitive file/directory names?
>>
>> Be careful, this is dangerous.
>
> Why?

There’s a bit of extra attack surface not present in a case-sensitive
filesystem, i.e. the code to do case-insensitive comparisons.

AFAIK you’re already buying into that if you use SMB, FAT, etc though,
and filesystems are already rather complex code (IMO much more so than
even a fairly full-featured Unicode implementation). So at this level I
would say “fractionally more risky” than “dangerous”.

A more concrete issue is that where a collection of files (e.g. a zip
archive, a git repo, etc) contains files that differ only in letter
case, it can’t be represented correctly in a case-independent
filesystem.

Examples:

https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man3
(NAN.3 and nan.3)

https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2
(_Exit.2 and _exit.2)

https://github.com/torvalds/linux/tree/master/net/netfilter
(xt_hl.c and xt_HL.c)

The effect is that you can’t successfully clone the manpages or kernel
trees onto a case-insensitive filesystem. For the most part that’s
inconvenient rather than dangerous though though I certainly wouldn’t
want to exclude the possibility that someone’s managed to snooker
themselves into a process which would be genuinely exploitatable this
way.

--
https://www.greenend.org.uk/rjk/

On 08/02/2024 11:15, Richard Kettlewell wrote:
> Lawrence D'Oliveiro <ldo@nz.invalid> writes:
>> On Thu, 8 Feb 2024 04:28:13 +0100, Carlos E.R. wrote:
>>> On 2024-02-08 02:48, Lawrence D'Oliveiro wrote:
>>>> Did you know that the ext4 filesystem has the option for
>>>> case-insensitive file/directory names?
>>>
>>> Be careful, this is dangerous.
>>
>> Why?
>
> There’s a bit of extra attack surface not present in a case-sensitive
> filesystem, i.e. the code to do case-insensitive comparisons.
......
....

In the end it breaches the guideline that you should always do whatever
the incompetent programmer who built the system expected you to do.

Unless its a feature you need, simply don't use it.

--
Canada is all right really, though not for the whole weekend.

"Saki"

On 2024-02-08 11:58, Richard Kettlewell wrote:
> Grant Taylor <gtaylor@tnetconsulting.net> writes:
>> On 2/7/24 21:57, Lawrence D'Oliveiro wrote:
>>> On Thu, 8 Feb 2024 04:28:13 +0100, Carlos E.R. wrote:
>>>> On 2024-02-08 02:48, Lawrence D'Oliveiro wrote:
>>>>> Did you know that the ext4 filesystem has the option for
>>>>> case-insensitive file/directory names?
>>>>
>>>> Be careful, this is dangerous.
>>> Why?
>> It's a fundamental paradigm change that goes against one of the things
>> that is related to security.
>>
>> E.g. PATH=/usr/local/bin:/usr/bin:/bin
>>
>> Which executable is run first when you type `su`?
>>
>> - /usr/local/bin/SU
>> - /usr/bin/sU
>> - /bin/su
>
> What’s the threat model here?

It is not about threats.

--
Cheers, Carlos.

On 2024-02-08 04:57, Lawrence D'Oliveiro wrote:
> On Thu, 8 Feb 2024 04:28:13 +0100, Carlos E.R. wrote:
>
>> On 2024-02-08 02:48, Lawrence D'Oliveiro wrote:
>>
>>> Did you know that the ext4 filesystem has the option for
>>> case-insensitive file/directory names?
>>
>> Be careful, this is dangerous.
>
> Why?

Because the filesystem structure is designed considering the case is
relevant.

You would have to examine all the files in your distribution, to check
that there are no collisions. Check all the scripts, all the programs.

Huge overtaking.

You can, however, do it for a data directory of your design. For
example, if you have a directory which you export via samba to windows
machines, that directory could be useful to be case insensitive.

/sambashare

--
Cheers, Carlos.

On 08/02/2024 13:05, Carlos E.R. wrote:

> Because the filesystem structure is designed *considering the case is
> relevant*.
>
That is the killer. It's like taking a car designed for a 1.5 litre
engine and cramming a supercharged 6 litre in it. Things will simply break.

> You would have to examine all the files in your distribution, to check
> that there are no collisions. Check all the scripts, all the programs.
>
> Huge overtaking.
>
Undertaking...
>
> You can, however, do it for a data directory of your design. For
> example, if you have a directory which you export via samba to windows
> machines, that directory could be useful to be case insensitive.
>
> /sambashare
>
Moving away from uppercase DOS 6x.3x filenames was a step forward. Why
would anyone go back?

--
"The great thing about Glasgow is that if there's a nuclear attack it'll
look exactly the same afterwards."

Billy Connolly

"Carlos E.R." <robin_listas@es.invalid> writes:
> On 2024-02-08 11:58, Richard Kettlewell wrote:
>> Grant Taylor <gtaylor@tnetconsulting.net> writes:
>>> It's a fundamental paradigm change that goes against one of the things
>>> that is related to security.
>>>
>>> E.g. PATH=/usr/local/bin:/usr/bin:/bin
>>>
>>> Which executable is run first when you type `su`?
>>>
>>> - /usr/local/bin/SU
>>> - /usr/bin/sU
>>> - /bin/su
>> What’s the threat model here?
>
> It is not about threats.

Grant seems to think it is; he explicitly mentioned security.

--
https://www.greenend.org.uk/rjk/

"Carlos E.R." <robin_listas@es.invalid> writes:
> On 2024-02-08 04:57, Lawrence D'Oliveiro wrote:
>> On Thu, 8 Feb 2024 04:28:13 +0100, Carlos E.R. wrote:
>>> Be careful, this is dangerous.
>> Why?
>
> Because the filesystem structure is designed considering the case is
> relevant.
>
> You would have to examine all the files in your distribution, to check
> that there are no collisions. Check all the scripts, all the programs.
>
> Huge overtaking.

Doing the check on an installed system is a shell one-liner (and it
produces a few dozen hits on my system). Doing it on, say, a
distribution archive would be a little more but it’s not really a
difficult task.

However I don’t see Lawrence advocating doing it to whole system
(i.e. /) so much as individual volumes or even directories.

--
https://www.greenend.org.uk/rjk/

On 2024-02-08 15:14, Richard Kettlewell wrote:
> "Carlos E.R." <robin_listas@es.invalid> writes:
>> On 2024-02-08 04:57, Lawrence D'Oliveiro wrote:
>>> On Thu, 8 Feb 2024 04:28:13 +0100, Carlos E.R. wrote:
>>>> Be careful, this is dangerous.
>>> Why?
>>
>> Because the filesystem structure is designed considering the case is
>> relevant.
>>
>> You would have to examine all the files in your distribution, to check
>> that there are no collisions. Check all the scripts, all the programs.
>>
>> Huge overtaking.
>
> Doing the check on an installed system is a shell one-liner (and it
> produces a few dozen hits on my system). Doing it on, say, a
> distribution archive would be a little more but it’s not really a
> difficult task.

The point is, you never know what script or program may create or access
a file of the same name but different case as another part of the
program or another program. You can never be sure.

> However I don’t see Lawrence advocating doing it to whole system
> (i.e. /) so much as individual volumes or even directories.

That's feasible. For a Samba share, it would be desirable, it can avoid
trouble in Windows programs that expect case to not matter.

--
Cheers, Carlos.

On 2024-02-08 14:32, The Natural Philosopher wrote:
> On 08/02/2024 13:05, Carlos E.R. wrote:
>
>> Because the filesystem structure is designed *considering the case is
>> relevant*.
>>
> That is the killer. It's like taking a car designed for a 1.5 litre
> engine and cramming a supercharged 6 litre in it. Things will simply break.
>
>> You would have to examine all the files in your distribution, to check
>> that there are no collisions. Check all the scripts, all the programs.
>>
>> Huge overtaking.
>>
> Undertaking...

Oops :-)

>>
>> You can, however, do it for a data directory of your design. For
>> example, if you have a directory which you export via samba to windows
>> machines, that directory could be useful to be case insensitive.
>>
>> /sambashare
>>
> Moving away from uppercase DOS 6x.3x filenames was a step forward. Why
> would anyone go back?

In current day Windows you can name files with upper, lower, mixed case.
No matter how you do it, in Windows it is the same file. It is simply a
prettier file name.

--
Cheers, Carlos.

On Thu, 8 Feb 2024 09:42:56 +0000, The Natural Philosopher wrote:

> I once mistakenly added a case sensitive disk to an Apple OS/X machine.
> Applications promptly stopped working.

That’s the opposite of what we’re discussing here.

On Thu, 08 Feb 2024 14:14:29 +0000, Richard Kettlewell wrote:

> However I don’t see Lawrence advocating doing it to whole system (i.e.
> /) so much as individual volumes or even directories.

Which is precisely why the feature is designed that way.

On Thu, 08 Feb 2024 11:15:53 +0000, Richard Kettlewell wrote:

> A more concrete issue is that where a collection of files (e.g. a zip
> archive, a git repo, etc) contains files that differ only in letter
> case, it can’t be represented correctly in a case-independent
> filesystem.

The solution is simple: create a case-sensitive directory, and extract the
archive there.

Consider that Windows users have this same problem, without having
recourse to the same solution.

On Thu, 8 Feb 2024 13:59:04 +0100, Carlos E.R. wrote:

> On 2024-02-08 11:58, Richard Kettlewell wrote:
>
>> Grant Taylor <gtaylor@tnetconsulting.net> writes:
>>
>>> E.g. PATH=/usr/local/bin:/usr/bin:/bin
>>>
>>> Which executable is run first when you type `su`?
>>>
>>> - /usr/local/bin/SU
>>> - /usr/bin/sU
>>> - /bin/su
>>
>> What’s the threat model here?
>
> It is not about threats.

It’s not about anything at all, really. It’s a question about a non-
problem.

On Thu, 08 Feb 2024 02:48:02 Lawrence D'Oliveiro wrote:
> Did you know that the ext4 filesystem has the option for case-insensitive
> file/directory names?[...]

I did not know and in fact I cannot think of a situation where I
would desire case-insensitivity. But of course it helps to be aware
of this possibility just in case one runs into a system configured
this way. Thanks.

--
M.O.

On 2/7/24 23:45, Lawrence D'Oliveiro wrote:
> The first one that matches, same as now.

I disagree.

`su` (lower case) is decidedly not `SU` upper case.

And if your system was using case insensitive files like you are
suggesting and I arranged to put `SU` in a directory earlier in your
path, you just ran a trojan when you mean to run `su`.

This is a first hand example of why case folding is a Bad Idea (TM).

--
Grant. . . .

On 2/8/24 04:58, Richard Kettlewell wrote:
> What’s the threat model here?

It's different for different people.

> If an attacker can put a hostile command sU in /usr/bin, they must have
> been able to write /usr/bin, in which case they could just replace
> /usr/bin/su with their own version. They don’t need a case-insensitive
> filesystem to do that.

The examples I gave were exactly that, overt examples meant to
demonstrate a concept. There are MANY subtle ways that this type of
thing can bite you.

What if someone has `.` as the first directory in their PATH
(.:/usr/local/bin:/usr/bin:/bin type thing) and the are in (their
current working directory is) /tmp, and someone places a file named `SU`
-- which is a wrapper around /bin/su -- and the person runs `su` to do
something. The person unwittingly / inadvertently ran /tmp/SU instead
of the expected /bin/su.

There are multiple things that work in concert with each other to result
in unexpected and likely unwanted behavior of the system. Each of the
things is in and of itself innocuous enough. But combined ... unwanted
things can easily, if not likely, happen.

Depending exactly on how the case folding works, what library is used
when someone needs to load libnss_dns.so:

/lib/LIBNSS_DNS.SO
/lib/LiBnSs_DnS.sO
/lib/libnss_dns.so

It may be entirely possible to have mixed case files on the file system
but have the system do things to fold case when trying to access files.
Which file will be accessed?

> If a legitimate administrator has created /usr/bin/sU, with different
> behavior to /usr/bin/su, they’re only attacking themselves.

Maybe. Maybe not.

This class of problem, case confusion, can bite in a LOT of different
ways in a LOT of different ways.

What if two users named Bob exist on the system from when case folding
wasn't enabled:

/home/BOB
/home/bob

Case folding is enabled.

Eliding authentication issues, which home directory is used?

--
Grant. . . .

On 2/8/24 08:04, Richard Kettlewell wrote:
> Grant seems to think it is; he explicitly mentioned security.

Security is the most obvious / easiest place to demonstrate problems
that arise from case confusion.

--
Grant. . . .