Hacker News Reader

Comment by mardifoufs | Hacker News Reader

Is there a Linux equivalent for those "filters"? I'm a bit clueless about win32 and NT sadly enough...

Would that mean that there's no way to "scope" the MFTs?

Edit: That also makes sense, since if I got it right they aren't necessarily supposed to be consumed by userspace programs?

I guess that's why those tools always ask for admin access and basically all perms to the FS.

It's a bit sad that the user gets exposed to a much slower search and FS experience even if the system underneath has the potential to be as fast as it gets. And I don't think ReFS is intended to replace NTFS (not that it's necessarily more performant anyways)

View on HN

There is no equivalent on Linux. That's why linux has no online antivirus scanners (scanners that scan the file as it's opened) while this is a basic feature of every antivirus program on Windows.

Linux has device mappers (dm-crypt, dm-raid and friends). But those sit below the file system, emulating a device. Window's file system filter drivers sit above the file system, intercepting API calls to and from the file system. That's super useful if you want to check file contents on access, track where files are going, keep an audit log of who accessed a file, transparently encrypt single files instead of whole volumes, etc. But you pay the price for all that flexibility in performance.

Sure there is, you're talking about fanotify.

https://man7.org/linux/man-pages/man7/fanotify.7.html

https://lwn.net/Articles/339399/

It even lets you block the access until the scan/decision is made.

> That's super useful if you want to check file contents on access, track where files are going, keep an audit log of who accessed a file, transparently encrypt single files instead of whole volumes

Or if you just want to generally make the filesystem so slow that everyone has to invent their own pack files just to avoid file system api calls as much as possible.

What are the APIs related to this named?

IO Minifilter drivers are the modern version: https://learn.microsoft.com/en-us/windows-hardware/drivers/i...

Filters are vaguely similar to things like mountpoints overlaying portions of the filesystem. E.g. in Linux you might have files in /d1/d2/{f1,f2,f3} in the root filesystem but you also have a mountpoint of a 2nd filesystem on /d1/d2 that completely changes the visibility / contents of d2. Filter drivers can do similar things (although they are not actually independent mountpoints).

I believe they're approximately equivalent to FUSE

Reply on news.ycombinator.com