Arch Linux

go to https://bugs.archlinux.org/task/63119.

unable to edit task's title or main body?

replaced with https://bugs.archlinux.org/task/63120.

Don't submit the same bug three times, we can fix the title of this one -- but the duplicate bug records are there forever.

Despite your submitting the bug three times, I'm still not sure exactly what you want. Each time you said the exact same thing.

What is wrong with uuids, how is using /dev/disk/by-path supposed to solve it, and what is your proposal to get that information in an automated manner?

Note that genfstab already supports any lsblk -o TYPE column as the specifier.

His concern seems to be that a malicious device could offer an intentional UUID collision (easily done, you can just set the FS UUID at generation) and thus you'd end up mounting the wrong device (at random)
Therefore he'd like to have FS mounted from fstab using the device path ("/dev/disk/by-path/pci-0000:00:12.3-ata-4-part5") etc.

The problem with this (leaving aside any discussion about implications of such attack) is that afaics fstab doesn't support that syntax to begin with (so pointless in genfstab), so instead of fstab you'd have to write some static systemd mount units.

fstab supports using the actual description "/dev/disk/by-*" -- of course that relied on having something to set up such symlinks. Oops -- look at that untrusted boot device running malicious code.

genfstab is not a tool for protecting against some malicious attacker who is sitting in front of your computer plugging in untrusted hardware devices. My suggestion would be to look for the culprit in a mirror! Regardless, anyone who is seriously worried about this sort of attack vector is fully capable of rewriting their fstab by hand to reference udev-dependent paths. I don't see what utility genfstab would gain by adding such an option though.

Am I still missing something? @dou4cc?

sorry for shitposting.

> genfstab is not a tool for protecting against some malicious attacker who is sitting in front of your computer plugging in untrusted hardware devices.

in my opinion, booting PC with untrustable flash disk plugged on should be a common, safe practise.

> Oops -- look at that untrusted boot device running malicious code.

well, boot device has to be assumed trustable anyway.

s/plugged on/plugged in/g

path-based addressing isn't stable. Your BIOS is free to reorder these things however it wants, and may do so on every bootup. While this works for *your* use case, it will not work for every use case.

If you want to protect against rando USB devices, then use usbguard. If you still really want to try using by-path in fstab, then do that. I really don't think genfstab needs to support this niche.