Is There Any Reference Implementation of Linux File System Filter Driver

Developing File Systems for linux, mac, windows

Implementing a virtual file system is very OS-specific. The reason is that architecture of drivers is different in Unix-like OS and in Windows.

To avoid writing your own driver, you can use user-mode file system toolkit. On Linux, BSD and MacOS there exist FUSE and OSXFUSE (fork of now-inactive MacFUSE) respectively. On Windows our Callback File System is used.

Dropbox at the moment doesn't have a virtual file system but only shell extension (afaik they planned to create a virtual disk but I don't know what they have decided).

Regarding how file changes are tracked: there exist several methods. The simplest is to scan the directory on timer and compare timestamps and file sizes. Next, one can use FindFirstChangeNotification WinAPI function. And the most sophisticated and most reliable method is to use a filesystem filter driver. On Windows our CallbackFilter can be used. On MacOS X and on Linux you can get post-notifications similar to what FileSystemWatcher offers in .NET/Windows. In particular, on Linux, one can use inotify.

Best linux filesystem filter option?

I have chosen RedirFS Redirecting Filesystem Framework.

• similar to windows minifilter drivers in many ways
• simple enough and featurefull
• has examples of programs
• nice docs (but scattered)

How to trap file access attempts with a filter driver (kernel) and offer dialog to allow/deny (user)?

You (a.k.a. I) have pretty much enumerated the possibilities. Either poll the way FileMon does, or pass an event. Passing the event is probably a bit more error prone, and if you aren't a threading guru then there's probably more chance for error. But if you tend to make lots of mistakes then device drivers may not be for you...skydiving might be a poor choice too.

I'll offer taking a look at this project, but please note the disclaimers in the README. (It is only a test and investigation):

https://github.com/hostilefork/CloneLocker

And yes, to the extent that Microsoft and their driver model is to be something one worries about, miniFilters are the better choice these days.

---

Related Topics