The traditional method of dealing with filesystem images is to mount them as loopback devices, and that is a simple, elegant and universal way to change its contents in any way you feel fit. It has the disadvantage, however, of requiring superuser privileges — which you may not have in every host you frequent, or you wisely don’t wish to grant to anyone using your machine to develop filesystem images. Christian Hohnstädt’s e2fsimage solves the problem allowing one to copy an entire subtree into a image file, but what if you want to extract, examine or manipulate arbitrary content?

Fake2fs is conceived as a fakeroot-style wrapper that redirects filesystem-related calls under a “ghost” mountpoint to a filesystem image, using standard unmodified utilities (to list the contents of your filesystem image, just run fake2fs ls /fake; to create a tarball with its contents, run fake2fs tar cf foo.tar /fake). There are three main strategies to implement this:

  1. A libc wrapper to be loaded using LD_PRELOAD. This is the faster and easier approach to implement and debug basic functionality, but requires reimplementation of more complex subsystems such as stream-based I/O. Other clear disadvantage is that it only works with programs dinamically linked to (a certain implementation of) libc.
  2. A ptrace-based syscall interceptor. It requires more groundwork since we have syscall replacements in a different process (with a separate address space), so using a copy_from_user/copy_to_user system is needed. It is generally more delicate code-wise, architecture-specific and harder to debug, but works with any binary, dinamically or statically linked. It also requires fewer (and simpler) calls to implement.
  3. A Jockey interposer approach of scanning text sessions and replacing syscall invocations (which seems, at this point, a bit on the esoteric side and will be dealt with later, if needed).

Being the faster and easier to debug method, I initially implemented fake2fs using preload. It is (currently) largely incomplete but it already works in some cases (ls, cat, less, diff, grep, tar c and shells, for example). Current code available at the master branch of http://hellabs.org/git/fake2fs.git. The beginnings of a ptraced-based implementation is available at the ptrace branch.

Combined with fakeroot and a partition table manipulation utility, the idea is to streamline the disk image generation workflow for an embedded system from chroot-based masters (where the environment can be finetuned with chroot and Xephyr) to ready-to-deploy disk images (that can be checked with an emulator) before installing it on the real device. Superuser access is not needed at any point of the process.

3 Responses to “Faking filesystem access”

  1. Pascal Terjan says:

    Great !
    I had needed to manipulate a minix image as user and had found mfstool (http://fasmz.org/~pterjan/blog/?date=20070416#p02) but your approach is far better as you are not limited to a set of command

  2. wangji says:

    unable to get fake2fs to experiment

    how do I do with http://helllabs.org/git/fake2fs.git ??
    thanks

  3. claudio says:

    You can clone the git tree with ‘git clone http://helllabs.org/git/fake2fs.git‘. Read-only access should be mostly harmless, but be careful with write operations that currently result in filesystem corruption!

Leave a Reply