8 ms·

A Base Filesystem Project for macOS

119 points by mattbauer 10y ago

0x0 10y ago
It's always good to see open source projects published, especially for tricky and often under-documented stuff like file system kexts. Not to derail from this fine post, but I wanted to give a shoutout to FUSE for macOS (previously known as OSXFUSE). As an outsider from the project - merely a happy user - it seems to be a well maintained FUSE implementation for macOS, with signed kexts available. https://osxfuse.github.io/ https://osxfuse.github.io/
- azinman2 10y ago
  According to Dropbox it has performance & security risks: https://blogs.dropbox.com/tech/2016/05/going-deeper-with-project-infinite https://blogs.dropbox.com/tech/2016/05/going-deeper-with-pro...
  - sweettea 10y ago
    According to Dropbox, it has performance implications and is complicated thereby introducing a large attack surface. For some reason, they believe their own kernel module is less complicated and easier to reason about than FUSE, despite having more in-kernel code and not being open source; I would venture to say their words about security are more about control of the attack surface rather than any actual implications about the quality of the FUSE code.
  - Longhanks 10y ago
    According to Dropbox it is okay to circumvent security mechanisms of the operating system (https://news.ycombinator.com/item?id=12463338 https://news.ycombinator.com/item?id=12463338) unless the media discovers your shady way of tricking the user into granting you full system access. Their lost a lot of their credibility in my opinion.
- jjtheblunt 10y ago
  why are there kexts in file system user space extensions? in OSX multiple driver types can exist entirely in user space, with no kext. [ former Apple engineer here ]
  - 0x0 10y ago
    Are you saying you can write a 100% user-space "driver" that allows for `mount`ing into the regular file system? How does that work? Can a non-root user supply the code running to serve /some/path that is visible for any process on the system, even root?
ianai 10y ago
Just yesterday I was thinking how all of the platforms are still using vfat as a go between. There really should be a new FS "for them all"
- nathancahill 10y ago
  https://xkcd.com/927/ https://xkcd.com/927/
  - DigitalJack 10y ago
    Pretty soon, we'll just use XKCD numbers and not bother linking. We'll just call something or other "hey, that's a 927"
    - Sophistifunk 10y ago
      We should create a URI standard for that; xkcd://927
      - rndgermandude 10y ago
        Let me propose the xkcd2 scheme, to be used like xkcd2:927, because who really needs those two slashes?!
        tychuz 10y ago
        My proposal: xkcd3, works as xkcd3:927 AND xkcd3://927 And that's why Linux desktop is going nowhere.
        jepler 10y ago
        hi, what about xkcd4:ⅽⅿⅹⅹⅶⅹ or xkcd5:٩٢٧ (note: may not appear in correct reading order due to technical limitations)
        10y ago
raimue 10y ago
In order to deploy and run your own kernel extensions on recent versions of the Mac operating system you will need to disable System Integrity Protection (SIP). Otherwise you will need a paid Apple developer account and ask Apple for a special codesigning certificate for kernel extensions. https://developer.apple.com/library/content/documentation/Security/Conceptual/System_Integrity_Protection_Guide/KernelExtensions/KernelExtensions.html https://developer.apple.com/library/content/documentation/Se...
rrggrr 10y ago
Akin to this is the keybase.io encrypted file system. It's in beta and brilliantly implemented so far.
deleted 10y ago
[deleted]

119 points by mattbauer 10y ago

0x0 10y ago

It's always good to see open source projects published, especially for tricky and often under-documented stuff like file system kexts. Not to derail from this fine post, but I wanted to give a shoutout to FUSE for macOS (previously known as OSXFUSE). As an outsider from the project - merely a happy user - it seems to be a well maintained FUSE implementation for macOS, with signed kexts available. https://osxfuse.github.io/ https://osxfuse.github.io/

azinman2 10y ago
According to Dropbox it has performance & security risks: https://blogs.dropbox.com/tech/2016/05/going-deeper-with-project-infinite https://blogs.dropbox.com/tech/2016/05/going-deeper-with-pro...
- sweettea 10y ago
  According to Dropbox, it has performance implications and is complicated thereby introducing a large attack surface. For some reason, they believe their own kernel module is less complicated and easier to reason about than FUSE, despite having more in-kernel code and not being open source; I would venture to say their words about security are more about control of the attack surface rather than any actual implications about the quality of the FUSE code.
- Longhanks 10y ago
  According to Dropbox it is okay to circumvent security mechanisms of the operating system (https://news.ycombinator.com/item?id=12463338 https://news.ycombinator.com/item?id=12463338) unless the media discovers your shady way of tricking the user into granting you full system access. Their lost a lot of their credibility in my opinion.
jjtheblunt 10y ago
why are there kexts in file system user space extensions? in OSX multiple driver types can exist entirely in user space, with no kext. [ former Apple engineer here ]
- 0x0 10y ago
  Are you saying you can write a 100% user-space "driver" that allows for `mount`ing into the regular file system? How does that work? Can a non-root user supply the code running to serve /some/path that is visible for any process on the system, even root?

ianai 10y ago

Just yesterday I was thinking how all of the platforms are still using vfat as a go between. There really should be a new FS "for them all"

nathancahill 10y ago
https://xkcd.com/927/ https://xkcd.com/927/
- DigitalJack 10y ago
  Pretty soon, we'll just use XKCD numbers and not bother linking. We'll just call something or other "hey, that's a 927"
  - Sophistifunk 10y ago
    We should create a URI standard for that; xkcd://927
    - rndgermandude 10y ago
      Let me propose the xkcd2 scheme, to be used like xkcd2:927, because who really needs those two slashes?!
      - tychuz 10y ago
        My proposal: xkcd3, works as xkcd3:927 AND xkcd3://927 And that's why Linux desktop is going nowhere.
        jepler 10y ago
        hi, what about xkcd4:ⅽⅿⅹⅹⅶⅹ or xkcd5:٩٢٧ (note: may not appear in correct reading order due to technical limitations)
        10y ago

raimue 10y ago

In order to deploy and run your own kernel extensions on recent versions of the Mac operating system you will need to disable System Integrity Protection (SIP). Otherwise you will need a paid Apple developer account and ask Apple for a special codesigning certificate for kernel extensions. https://developer.apple.com/library/content/documentation/Security/Conceptual/System_Integrity_Protection_Guide/KernelExtensions/KernelExtensions.html https://developer.apple.com/library/content/documentation/Se...

rrggrr 10y ago

Akin to this is the keybase.io encrypted file system. It's in beta and brilliantly implemented so far.

deleted 10y ago

[deleted]