[Dazuko-devel] DazukoFS 3.0.0-rc1 posted

[John Ogness]

Hi,

I am very happy (and excited) to announce that DazukoFS 3.0.0-rc1 has
been posted. I have spent the past month working on a complete rewrite
of the file access logic as well as the userspace interface. Many of
the ideas for the rewrite were inspired from the various discussions
that took place on the malware-list.

I will be writing an article for the Dazuko website that will go into
details about the changes (what they are and why they were made) and
discuss some very interesting benchmarks that were taken. But until I
find time for the article, I wanted to post a very brief set of
answers about DazukoFS.


1. Is DazukoFS compatible with Dazuko?

No. DazukoFS uses different devices and a new device protocol. The way
that DazukoFS interacts with userspace applications is also
different. (The userspace application receives a read-only, open file
descriptor to the file being accessed, rather than a filename.)


2. Is it possible to run Dazuko and DazukoFS at the same time?

Yes. Dazuko and DazukoFS are two totally different sets of code. There
is not a single line of code that is shared between them. DazukoFS is
a complete rewrite, focussing on security and performance, with no
considerations for backwards compatibility. This means that both
Dazuko and DazukoFS can run side by side without getting in each
other's way.


3. What is the future of Dazuko?

DazukoFS is the future and as of 3.0.0, it will be the official stable
version. The website and documentation will be changed to focus
exclusively on DazukoFS. As I have mentioned in the past, I have no
intentions of maintaining Dazuko 2.x for the future. I may release a
2.4.0 version that runs only as a RedirFS filter. That's the only real
future I see for the 2.x series. I have absolutely no interest in
continuing to play LSM or syscall games.


4. What about DazukoFS in Linux mainline?

After a 3.0.0 release, I will be devoting serious efforts to getting
DazukoFS included in the kernel. In my opinion, the methods used by
DazukoFS should be acceptable (and welcomed) by the Linux kernel
community.


5. What about FreeBSD?

DazukoFS is currently only available for Linux. It does not include a
platform-independent layer, like Dazuko 2.x does. At some point I may
work to provide DazukoFS for FreeBSD (and other systems). But right
now my focus is Linux.


6. Is DazukoFS stable?

I have done many tests on DazukoFS (with ext3) and am absolutely
amazed at its stability. In my opinion, it is just as stable as the
current Dazuko stable version.


7. Is DazukoFS complete?

DazukoFS is based on the nullfs work I did. There are many filesystem
calls that are not being hooked. This means that DazukoFS probably
won't work on some filesystems. There is also no support for mmap()
writes. These features will not be included in the 3.0.0 release.


8. Does DazukoFS have all the feature of Dazuko?

No. DazukoFS does not include a trusted application framework. It also
does not allow _any_ program to access files without triggering
events, not even registered applications. (Since a registered
application receives an open file descriptor, it can scan the file
contents without needing to perform a file open.) I believe the
trusted application framework was an important feature, so I am
interested in implementing it for DazukoFS as well. But for now it is
not included.

DazukoFS does include one feature that Dazuko does not have. Groups
can be removed when they are no longer needed.


9. Is DazukoFS really that much faster?

YES! Here is simple summary of a file system test I performed (working
purely in cache, no physical hard drive access). The details of the
test and meaning of the results will be discussed in the article I
will write.

times (in seconds) -->     user        sys        real

no Dazuko/DazukoFS        9.740      1.900      11.648
DazukoFS (1 group)        7.440      4.120      16.118
DazukoFS (2 groups)       8.300      4.430      21.223
DazukoFS (3 groups)       7.640      5.500      26.423
Dazuko (1 group)         10.330     10.200      35.519
Dazuko (2 groups)        10.120     17.890      84.836
Dazuko (3 groups)         9.980     27.000     165.466

(A "group" is a registered group for Dazuko.)

In summary, running DazukoFS with 3 groups is still considerably
faster than running Dazuko with just 1 group. And as can be seen,
DazukoFS scales nicely when adding more groups, whereas Dazuko is a
disaster.


I encourage Dazuko application developers to play around with the
DazukoFS package. A test program is included. I think you will be
impressed by the simplicity and speed of DazukoFS. There is a lot of
documentation to be written still, so be patient. But feel free to
post questions or problems.

John Ogness

-- 
Dazuko(FS) Maintainer