FS filters on Unix/Lynux/Mac?

NTFSD
1

Is there such thing in “their” world? In other words, can one write a
monitor, similar to FILEMON, that would intercept all file I/O at the
time they happen? If so, how long will it take for, lets say, an
intermediate dev to create a FILEMON prototype on one of those OSes?
I know this is no the best place to ask this question (hopefully it’s
not going to provoke another “holly war”), but these times and in this
company you simply can’t start Windows project until you proved that it
can be ported to at least Lyn/Ux.

TIA,

Vladimir

2

Vladimir,

We were doing something comparable to this on UNIX platforms supporting
a VFS style interface in the 1980s. There was a concept of a
“stackable” file system as well, which was similar to the file system
filter model that we use in Windows. Basically, in the VFS interface
model, each file system has a table of entry points and we would
“capture” those entry points by swapping the tables.

As for Linux, I haven’t looked at their file system stack in a long time

  • long enough ago that they were not using a VFS style switch for it.
    Perhaps they do so now.

Implementing such a piece of code on a UNIX with VFS shouldn’t take much
time or effort - there are code samples. Of course, just like Windows
file system filters, the fun part is once you have them “hooked” you
have to figure out what to do with all of the I/O operations. I don’t
recall that it was really any easier on any of the UNIX platforms with
nice integrated VM systems than it is on Windows.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osronline.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Vladimir Chtchetkine
Sent: Thursday, February 12, 2004 11:13 AM
To: ntfsd redirect
Subject: [ntfsd] FS filters on Unix/Lynux/Mac?

Is there such thing in “their” world? In other words, can one write a
monitor, similar to FILEMON, that would intercept all file I/O at the
time they happen? If so, how long will it take for, lets say, an
intermediate dev to create a FILEMON prototype on one of those OSes?
I know this is no the best place to ask this question (hopefully it’s
not going to provoke another “holly war”), but these times and in this
company you simply can’t start Windows project until you proved that it
can be ported to at least Lyn/Ux.

TIA,

Vladimir

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

Thanks, Tony!

One down, two to go :slight_smile:

-----Original Message-----
From: Tony Mason [mailto:xxxxx@osr.com]
Sent: Thursday, February 12, 2004 8:45 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] FS filters on Unix/Lynux/Mac?

Vladimir,

We were doing something comparable to this on UNIX platforms supporting
a VFS style interface in the 1980s. There was a concept of a
“stackable” file system as well, which was similar to the file system
filter model that we use in Windows. Basically, in the VFS interface
model, each file system has a table of entry points and we would
“capture” those entry points by swapping the tables.

As for Linux, I haven’t looked at their file system stack in a long time

  • long enough ago that they were not using a VFS style switch for it.
    Perhaps they do so now.

Implementing such a piece of code on a UNIX with VFS shouldn’t take much
time or effort - there are code samples. Of course, just like Windows
file system filters, the fun part is once you have them “hooked” you
have to figure out what to do with all of the I/O operations. I don’t
recall that it was really any easier on any of the UNIX platforms with
nice integrated VM systems than it is on Windows.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osronline.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Vladimir Chtchetkine
Sent: Thursday, February 12, 2004 11:13 AM
To: ntfsd redirect
Subject: [ntfsd] FS filters on Unix/Lynux/Mac?

Is there such thing in “their” world? In other words, can one write a
monitor, similar to FILEMON, that would intercept all file I/O at the
time they happen? If so, how long will it take for, lets say, an
intermediate dev to create a FILEMON prototype on one of those OSes?
I know this is no the best place to ask this question (hopefully it’s
not going to provoke another “holly war”), but these times and in this
company you simply can’t start Windows project until you proved that it
can be ported to at least Lyn/Ux.

TIA,

Vladimir

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as:
xxxxx@borland.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

4

Check out the work done by Erez Zadok and company at Stony Brook and
Columbia.

http://www.filesystems.org
http://www.cs.sunysb.edu/~ezk/
http://www1.cs.columbia.edu/~ezk

/ted

-----Original Message-----
From: Vladimir Chtchetkine [mailto:xxxxx@borland.com]
Sent: Thursday, February 12, 2004 11:13 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FS filters on Unix/Lynux/Mac?

Is there such thing in “their” world? In other words, can one write a
monitor, similar to FILEMON, that would intercept all file I/O at the time
they happen? If so, how long will it take for, lets say, an intermediate dev
to create a FILEMON prototype on one of those OSes? I know this is no the
best place to ask this question (hopefully it’s not going to provoke another
“holly war”), but these times and in this company you simply can’t start
Windows project until you proved that it can be ported to at least Lyn/Ux.

TIA,

Vladimir

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@livevault.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

5

What I’ve seen done and have done myself on Linux 2.4, on volume and disk
drivers, is what is to store off the current dispatch function pointers and
replace them with your own. Then you just have to call the function like
hooking DOS interrupts.

I found this technique about a year ago while searching for Linux Filter
Driver on the web.

I’ll post my code if I come across it.

Good Luck,

Jonathan

“Vladimir Chtchetkine” wrote in message
news:xxxxx@ntfsd…
Is there such thing in “their” world? In other words, can one write a
monitor, similar to FILEMON, that would intercept all file I/O at the
time they happen? If so, how long will it take for, lets say, an
intermediate dev to create a FILEMON prototype on one of those OSes?
I know this is no the best place to ask this question (hopefully it’s
not going to provoke another “holly war”), but these times and in this
company you simply can’t start Windows project until you proved that it
can be ported to at least Lyn/Ux.

TIA,

Vladimir

6

Thank you all, guys!

Looks like for Ux and Lx I’m covered :slight_smile: I’m not that concerned about
Mac at this point.

Vladimir

-----Original Message-----
From: Vladimir Chtchetkine [mailto:xxxxx@borland.com]
Sent: Thursday, February 12, 2004 8:13 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FS filters on Unix/Lynux/Mac?

Is there such thing in “their” world? In other words, can one write a
monitor, similar to FILEMON, that would intercept all file I/O at the
time they happen? If so, how long will it take for, lets say, an
intermediate dev to create a FILEMON prototype on one of those OSes?
I know this is no the best place to ask this question (hopefully it’s
not going to provoke another “holly war”), but these times and in this
company you simply can’t start Windows project until you proved that it
can be ported to at least Lyn/Ux.

TIA,

Vladimir

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as:
xxxxx@borland.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

7

Vladimir,

At this point, the OS on the MAC is a UNIX variant, so I suspect you
will find that much of what works for other UNIX variants will apply as
well.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Vladimir Chtchetkine
Sent: Thursday, February 12, 2004 4:14 PM
To: ntfsd redirect
Subject: RE: [ntfsd] FS filters on Unix/Lynux/Mac?

Thank you all, guys!

Looks like for Ux and Lx I’m covered :slight_smile: I’m not that concerned about
Mac at this point.

Vladimir

-----Original Message-----
From: Vladimir Chtchetkine [mailto:xxxxx@borland.com]
Sent: Thursday, February 12, 2004 8:13 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FS filters on Unix/Lynux/Mac?

Is there such thing in “their” world? In other words, can one write a
monitor, similar to FILEMON, that would intercept all file I/O at the
time they happen? If so, how long will it take for, lets say, an
intermediate dev to create a FILEMON prototype on one of those OSes?
I know this is no the best place to ask this question (hopefully it’s
not going to provoke another “holly war”), but these times and in this
company you simply can’t start Windows project until you proved that it
can be ported to at least Lyn/Ux.

TIA,

Vladimir

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as:
xxxxx@borland.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

8

We were looking at supporting our product under Mac OS 10 in a similar
manner to our Windows product. At present the Mac OS does not support VFS
stack drivers. Rumour has it that it may come back in the future, but the
Max guru here says he doubts it. You could munge the kernel to do it but
that is a bit of a kludge

Ben Curley
DESlock+ Lead Developer
Data Encryption Systems Ltd.

Tel: +44 (0)1823 352357 (Main)
Tel: +44 (0)1823 358320 (Direct Dial)

Web: http://www.deslock.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Tony Mason
Sent: 12 February 2004 21:40
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] FS filters on Unix/Lynux/Mac?

Vladimir,

At this point, the OS on the MAC is a UNIX variant, so I suspect you
will find that much of what works for other UNIX variants will apply as
well.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Vladimir Chtchetkine
Sent: Thursday, February 12, 2004 4:14 PM
To: ntfsd redirect
Subject: RE: [ntfsd] FS filters on Unix/Lynux/Mac?

Thank you all, guys!

Looks like for Ux and Lx I’m covered :slight_smile: I’m not that concerned about
Mac at this point.

Vladimir

-----Original Message-----
From: Vladimir Chtchetkine [mailto:xxxxx@borland.com]
Sent: Thursday, February 12, 2004 8:13 AM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] FS filters on Unix/Lynux/Mac?

Is there such thing in “their” world? In other words, can one write a
monitor, similar to FILEMON, that would intercept all file I/O at the
time they happen? If so, how long will it take for, lets say, an
intermediate dev to create a FILEMON prototype on one of those OSes?
I know this is no the best place to ask this question (hopefully it’s
not going to provoke another “holly war”), but these times and in this
company you simply can’t start Windows project until you proved that it
can be ported to at least Lyn/Ux.

TIA,

Vladimir

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as:
xxxxx@borland.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@osr.com To unsubscribe
send a blank email to xxxxx@lists.osr.com

Questions? First check the IFS FAQ at
https://www.osronline.com/article.cfm?id=17

You are currently subscribed to ntfsd as: xxxxx@des.co.uk
To unsubscribe send a blank email to xxxxx@lists.osr.com