4 ms·
Is there a Linux equivalent for those "filters"? I'm a bit clueless about win32 and NT sadly enough... Would that mean that there's no way to "scope" the MFTs?
by mardifoufs 2y ago
Is there a Linux equivalent for those "filters"? I'm a bit clueless about win32 and NT sadly enough...
Would that mean that there's no way to "scope" the MFTs?
Edit:
That also makes sense, since if I got it right they aren't necessarily supposed to be consumed by userspace programs?
I guess that's why those tools always ask for admin access and basically all perms to the FS.
It's a bit sad that the user gets exposed to a much slower search and FS experience even if the system underneath has the potential to be as fast as it gets. And I don't think ReFS is intended to replace NTFS (not that it's necessarily more performant anyways)
- webstrand 2y agoI believe they're approximately equivalent to FUSE
- loeg 2y agoFilters are vaguely similar to things like mountpoints overlaying portions of the filesystem. E.g. in Linux you might have files in /d1/d2/{f1,f2,f3} in the root filesystem but you also have a mountpoint of a 2nd filesystem on /d1/d2 that completely changes the visibility / contents of d2. Filter drivers can do similar things (although they are not actually independent mountpoints).
- wongarsu 2y agoThere is no equivalent on Linux. That's why linux has no online antivirus scanners (scanners that scan the file as it's opened) while this is a basic feature of every antivirus program on Windows. Linux has device mappers (dm-crypt, dm-raid and friends). But those sit below the file system, emulating a device. Window's file system filter drivers sit above the file system, intercepting API calls to and from the file system. That's super useful if you want to check file contents on access, track where files are going, keep an audit log of who accessed a file, transparently encrypt single files instead of whole volumes, etc. But you pay the price for all that flexibility in performance.
- Spivak 2y agoSure there is, you're talking about fanotify. https://man7.org/linux/man-pages/man7/fanotify.7.html https://man7.org/linux/man-pages/man7/fanotify.7.html https://lwn.net/Articles/339399/ https://lwn.net/Articles/339399/ It even lets you block the access until the scan/decision is made.
- SSLy 2y agoWhat are the APIs related to this named?
- mastax 2y agoIO Minifilter drivers are the modern version: https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/filter-manager-concepts https://learn.microsoft.com/en-us/windows-hardware/drivers/i...
- account42 2y ago> That's super useful if you want to check file contents on access, track where files are going, keep an audit log of who accessed a file, transparently encrypt single files instead of whole volumes Or if you just want to generally make the filesystem so slow that everyone has to invent their own pack files just to avoid file system api calls as much as possible.