Windows File System Proxy: FUSE for Windows

Thom Holwerda 2016-07-21 Windows 25 Comments

WinFsp is a set of software components for Windows computers that allows the creation of user mode file systems. In this sense it is similar to FUSE (Filesystem in Userspace), which provides the same functionality on UNIX-like computers.

Interesting project. They also provide details on how it works:

WinFsp consists of a kernel mode FSD (File System Driver) and a user mode DLL (Dynamic Link Library). The FSD interfaces with NTOS (the Windows kernel) and handles all interactions necessary to present itself as a file system driver to NTOS. The DLL interfaces with the FSD and presents an easy to use API for creating user mode file systems.

It’s open source, using the AGPLv3 license.

About The Author

Thom Holwerda

Follow me on Mastodon @[email protected]

25 Comments

2016-07-21 11:54 am

FunkyELF
It seems the Windows Subsystem for Linux is making great strides. I wonder if they could support FUSE with little effort?

2016-07-22 7:33 am

billziss
Hello. I am the original author of WinFsp. WinFsp has a native API, but it also supports the FUSE 2.8 (high-level) API.

Bill Zissimopoulos

2016-07-22 12:06 pm

Alfman verbose=1
billziss,

Hello. I am the original author of WinFsp. WinFsp has a native API, but it also supports the FUSE 2.8 (high-level) API.

Hello Bill! It’s nice to hear from the author. Way back in XP I also worked on NT file systems. I was kind of a rogue and used mingw instead of the MS DDK

I think this project has lots of potential, the previous contenders haven’t made it very far…

http://fuse.996288.n3.nabble.com/FUSE-for-Windows-td7788.html

But if this can deliver then having FUSE on windows fills in the missing gap for portable file systems and I can already think of many uses for it. I have a project in mind and I’m looking forward to giving this a shot,

2016-07-24 7:26 pm

billziss
Hello Bill! It’s nice to hear from the author. Way back in XP I also worked on NT file systems. I was kind of a rogue and used mingw instead of the MS DDK

[/q]

Can mingw be used to create drivers? That is definitely interesting.

[q]But if this can deliver then having FUSE on windows fills in the missing gap for portable file systems and I can already think of many uses for it. I have a project in mind and I’m looking forward to giving this a shot,

Excellent. Let me know if I can help. If you decide to ahead and have questions I will be happy to try to answer them at this google group:

https://groups.google.com/forum/#!forum/winfsp

2016-07-24 8:29 pm

Alfman verbose=1
billziss,

Can mingw be used to create drivers? That is definitely interesting. [/q]

Yes, yes it can

Once you get the build options sorted for creating the necessary imports/exports, it works well. I was even toying with C++. These days I’d even be interested in getting Rust to work, that is if I were still doing it.

The caveat I had at the time was mingw didn’t natively support the Structured Exception Handling used by microsoft in the kernel. So it was necessary to handle this myself although I think there may be mingw builds that support it now…

Here’s a link for those who don’t know what SEH is: http://www.programmingunlimited.net/siteexec/content.cgi?page=mingw…

[q]Excellent. Let me know if I can help. If you decide to ahead and have questions I will be happy to try to answer them at this google group:

Thank you. I’m developing a backup system but it’s just a standalone app and I’d like for it to be integrated as a native FS. I’ve tried using Microsoft’s native WebDAV support, which has the benefit of being fairly trivial and would have worked fine except I’ve found windows support for it to be infuriatingly inconsistent and buggy between windows versions. Authentication works differently on certain windows editions, some hardcode port 80, which may be used by another service, etc.

I’ve seen others emulating SMB, but what a headache

Fuse for windows would be perfect, really. So it’s exciting but I’m not sure when I’ll get to it, for me this falls into the unpaid work category, I guess it might for you too.

The FS driver I wrote back in the day could handle I/O requests but didn’t implement memory mapped IO blocks, which as I recall was required by notepad. It makes me curious how FUSE handles memory mapped IO. Is there some kind of block caching/syncing policy to make memory mapped IO work?

Edited 2016-07-24 20:49 UTC
2016-07-26 5:46 am

billziss

Thank you. I’m developing a backup system but it’s just a standalone app and I’d like for it to be integrated as a native FS. I’ve tried using Microsoft’s native WebDAV support, which has the benefit of being fairly trivial and would have worked fine except I’ve found windows support for it to be infuriatingly inconsistent and buggy between windows versions. Authentication works differently on certain windows editions, some hardcode port 80, which may be used by another service, etc.

I’ve seen others emulating SMB, but what a headache

[/q]

I hear you.

The reason I developed WinFsp was because I wanted to port a FUSE file system which runs on Linux and OSX to Windows. [It is a secure, transactional, POSIX file system over the cloud that I call Secfs – Secure Cloud File System]. I looked at some solutions including using WebDAV and SMB and found them wanting.

WinFsp is really a huge “detour” for me. Prior to developing WinFsp I had not done any Windows work in a long time.

for me this falls into the unpaid work category, I guess it might for you too.

Pretty much

[q]The FS driver I wrote back in the day could handle I/O requests but didn’t implement memory mapped IO blocks, which as I recall was required by notepad. It makes me curious how FUSE handles memory mapped IO. Is there some kind of block caching/syncing policy to make memory mapped IO work?

To clarify WinFsp implements FUSE as a compatibility layer over its own API. I do not know the details of how FUSE implements memory mapped I/O on Linux or OSX, but here is a very simplified overview of how it is done by Windows FSD’s and WinFsp.

Broadly speaking there are two kinds of read/write requests in Windows: cached requests and non-cached requests. Let us assume that the FSD receives a cached read request. This will be routed to the NT cache manager (Cc), which will try to satisfy it by doing a straight memory copy from the Cc’s memory into the calling process address space. Now if that memory is not present it will page fault and the memory manager (MM) will eventually send a recursive read to the FSD and mark it as “PagingIo”. At this point the FSD is supposed to go to its real storage (the disk, the network, the user mode file system) and try to satisfy that request.

Memory mapped I/O in Windows is simply I/O that is marked as PagingIo. In principle the FSD does not differentiate between PagingIo that is originated through the Cc or a memory mapped file.

Bill
2016-07-26 8:32 pm

Alfman verbose=1
billziss,

Broadly speaking there are two kinds of read/write requests in Windows: cached requests and non-cached requests.

Thanks for answering. There’s a lot I’ve forgotten, it’s hard to believe that it’s been a decade.

I see the webpage says only windows 8+ are tested. It happens I’m working with windows 7, and it’s not letting me install. It always fails at the “Status: Starting services” phase: “Service “WinFsp.Launcher’ (WinFsp.Launcher) failed to start. Verify that you have sufficient privileges to start system services.”

This was launched as administrator and I approved the UAC prompt to allow the Navimatics Corporation verified package to run.

Event viewer shows error 1920.

Anyways I’ll continue this on your google groups, I’ll have to create an account there first.

2016-07-24 4:30 pm

cm49
This looks very interesting. Is NFS suported?

2016-07-24 7:21 pm

billziss
WinFsp just provides the means to create a file system in user mode. You could use it to create an NFS client if you wanted. I have been toying with this idea although I don’t think I will have the time for it.

Here is an interesting project in case someone else thinks it would be cool to have an open source NFS client for Windows:

https://github.com/sahlberg/libnfs

2016-07-21 1:25 pm

cb88
“kernel mode FSD”… something which you would never be able to install on a Windows PC in production these days without being in development mode. They even mention this “bcdedit.exe -set testsigning” is the command used to enable it.

kernel mode FSDs require Microsoft to bless them… which costs a ton of money for a code review … and even then they’ll probably turn you down.

Edited 2016-07-21 13:27 UTC

2016-07-21 3:36 pm

avgalen
That makes perfect sense to me. For those few people that would need/want this it isn’t a big burden to say “okay, I am going to trust a major component on my system to be unverified” by running 1 simple command as an admin. For everyone else there shouldn’t be a reason to ever be able to do that

2016-07-21 3:44 pm

darknexus
That assumes Microsoft obeys my instructions forever. Given the way auto update settings mysteriously keep getting reset on Windows 8.1 systems in order to push 10, I’d not trust them not to revoke my trust, if you get my drift.
2016-07-21 5:43 pm

Alfman verbose=1
avgalen,

That makes perfect sense to me. For those few people that would need/want this it isn’t a big burden to say “okay, I am going to trust a major component on my system to be unverified” by running 1 simple command as an admin. For everyone else there shouldn’t be a reason to ever be able to do that

There are a couple serious issues with it. For starters you’ll be punished for using test mode:

https://www.reddit.com/r/survivetheculling/comments/498q3p/eac_drive…

Then there are the security implications. Just because I want to run my own driver doesn’t mean I want to allow all unsigned drivers, this is really pathetic on microsoft’s part. A far better solution would be to allow owners to set their own certificates in their own kernel.

Also, just because a driver has been signed under an MS approved CA chain doesn’t mean it’s safe. A hacker can buy an MS code signing key, some owners might want to further restrict the drivers allowed to run their computer, yet we’re not allowed to load a more restrictive & trustworthy CA.

Back when this all began and I was personally developing windows drivers, a tool was released and legitimately signed no less to allow owners to control their own chain of trust, yet every time the tool was released, windows update disabled the tool once again revoking owner control. It became clear that locking owners out was a goal rather than a side effect, and that’s why I abandoned windows kernel development.

2016-07-22 7:48 am

avgalen
There are a couple serious issues with it. For starters you’ll be punished for using test mode:

https://www.reddit.com/r/survivetheculling/comments/498q3p/eac_drive… [/q]
That isn’t a serious issue. That would only affect a very small subgroup of a small group and can easily be solved by adding a second boot-option and a quick reboot. I also think it is a completely valid reason for such games to check.

Then there are the security implications. Just because I want to run my own driver doesn’t mean I want to allow all unsigned drivers, this is really pathetic on microsoft’s part. A far better solution would be to allow owners to set their own certificates in their own kernel.

Setting this wouldn’t allow all unsigned drivers. Whenever you add a driver you still need to allow it to install (UAC) just like any other driver. (Also, you are not an owner but a licensee and it is surely not your own kernel)

[q]Also, just because a driver has been signed under an MS approved CA chain doesn’t mean it’s safe. A hacker can buy an MS code signing key

I am pretty sure you can only buy such a key after going through a procedure that would make you give up your identity. Trying this approach to hack peoples pc would be extremely difficult, expensive and would make it easy to get you arrested.

Driver signing is making hobby development like this hard and expensive. And with every new Windows version they add more hoops to jump through (secure boot, EV-certificates). There is a reason you see much more development like this on Linux than on Windows. Not a happy reason as you have also experienced

2016-07-22 11:08 am

Alfman verbose=1
avgalen,

That isn’t a serious issue. That would only affect a very small subgroup of a small group and can easily be solved by adding a second boot-option and a quick reboot. I also think it is a completely valid reason for such games to check. [/q]

I get it, you dismiss it because it doesn’t affect you, but it’s still a legitimate reason not to use testmode.

Setting this wouldn’t allow all unsigned drivers. Whenever you add a driver you still need to allow it to install (UAC) just like any other driver.

It opens up the attack surface though. The signatures would ordinarily get checked every time a driver is loaded, but in this case malware could hijack your driver and you’d be none the wiser because it’s not cryptographically signed. You’ve got to admit it could have been done better.

[q]I am pretty sure you can only buy such a key after going through a procedure that would make you give up your identity. Trying this approach to hack peoples pc would be extremely difficult, expensive and would make it easy to get you arrested.

http://arstechnica.com/security/2014/02/in-the-wild-phony-ssl-certi…

http://arstechnica.com/security/2012/06/flame-malware-was-signed-by…

http://www.securityweek.com/microsoft-blacklists-fake-windows-live-…

These are high profile forgeries, but impersonating small low tech companies is equally effective and far less likely to be caught.

Edit: You may not even have to generate a fraudulent certificate if you can find vulnerabilities in legitimate drivers that are already signed.

Edited 2016-07-22 11:19 UTC
2016-07-22 7:11 pm

darknexus
I get it, you dismiss it because it doesn’t affect you

Of course. That’s what proponents of greater corporate control do. It doesn’t affect them, so screw you! That’s their argument for more restrictions in a nutshell.
2016-07-22 8:25 pm

avgalen
I get it, you dismiss it because it doesn’t affect you, but it’s still a legitimate reason not to use testmode. [/q]
I don’t dismiss it at all. I acknowledge that it is AN issue, I even provide a very simple workaround (adding a second bootoption). That is why I disagree that it is a SERIOUS issue.

It opens up the attack surface though. The signatures would ordinarily get checked every time a driver is loaded, but in this case malware could hijack your driver and you’d be none the wiser because it’s not cryptographically signed.

I don’t think this would open up an attack surface. Malware that can hijack a kernel mode driver can already do anything that that kernel mode driver can do. This seems like a typical “It rather involved being on the other side of this airtight hatchway” (Raymond Chen)

You’ve got to admit it could have been done better.

Yes, it seems like you have some nice suggestion for this. Did you ever suggest them to Microsoft while you were doing this kind of work? You seem to know a lot about certificate (ab)use. The system isn’t perfect, but it works pretty well. The problem is that we have to trust Certificate Authorities and those have proven not to be perfect. Still it is a very high barrier to climb, with very little reward and very high risk.

I hope you also saw the comment about the nicely signed download.

[q]Of course. That’s what proponents of greater corporate control do. It doesn’t affect them, so screw you! That’s their argument for more restrictions in a nutshell.

Yes, nothing says “screw you” like providing a helpful workaround.

I don’t like greater corporate control in general but in this case it seems the benefits for the masses outweigh the slight inconvenience of the few.

Edited 2016-07-22 20:28 UTC
2016-07-22 11:15 pm

Alfman verbose=1
avgalen,

I don’t dismiss it at all. I acknowledge that it is AN issue, I even provide a very simple workaround (adding a second bootoption). That is why I disagree that it is a SERIOUS issue. [/q]

It’s not really fair for you to judge whether it’s serious for someone else. The restrictions were serious enough for me to abandon windows kernel development and I was pretty into it.

I don’t think this would open up an attack surface. Malware that can hijack a kernel mode driver can already do anything that that kernel mode driver can do. This seems like a typical “It rather involved being on the other side of this airtight hatchway” (Raymond Chen)

I see…someone should have told microsoft that signed drivers don’t help with the attack surface before they went through all this trouble of implementing them.

I hope you also saw the comment about the nicely signed download.

Absolutely, and I think it can prove useful. But it just means I can’t compile/tweak the source code myself, which is something FOSS developers normally expect to be able to do on their own machines. It ends up voiding long-cherished benefits for open source software, which I suspect was a deliberately calculated decision back in microsoft’s “Linux is a cancer” period. Even now, I don’t know if I can fully trust MS not to revoke the certificate in the future.

[q]Yes, nothing says “screw you” like providing a helpful workaround.

I don’t like greater corporate control in general but in this case it seems the benefits for the masses outweigh the slight inconvenience of the few.

I don’t think this touches on the root of the issue: Nobody’s arguing against the benefits, but there’s no reason that those benefits have to be disabled on FOSS developer machines. This doesn’t help anyone. You’ve made it very clear that the needs of the few don’t matter to you, and I guess if that’s the way you feel, then Q.E.D. But would you at least be able to admit that MS could handle it better if it wanted to?

Edited 2016-07-22 23:16 UTC
2016-07-25 4:57 pm

avgalen
It’s not really fair for you to judge whether it’s serious for someone else. The restrictions were serious enough for me to abandon windows kernel development and I was pretty into it. [/q]
You abandoned windows kernel development because you couldn’t play a game you liked? An issue that can be solved with just 1 command ( bcdedit -set TESTSIGNING OFF ). Or even better, a second boot option that allows you to choose between devving and gaming during startup? I stand by my assesment that this is not a serious issue in general, and shouldn’t have been a serious issue for you.

it just means I can’t compile/tweak the source code myself, which is something FOSS developers normally expect to be able to do on their own machines.

That signed download is for developers that want to use the compiled version to create drivers that use this framework. Those drivers wouldn’t need to be signed themselves because they would run in usermode.

And you still have to possibility to change the source of the framework itself as well, but then you loose the signed driver benefit and have to use that 1 command up there. Not perfect, but just a minor inconvenience

Nobody’s arguing against the benefits, but there’s no reason that those benefits have to be disabled on FOSS developer machines.

In their current implementation they do have to be disabled on FOSS developer machines that do kernel level driver development.

This doesn’t help anyone.

I thought nobody’s arguing against the benefits. So it helps the > 99% of users.

You’ve made it very clear that the needs of the few don’t matter to you

The needs of the few do matter to me, just ask my very limited collection of wive/children/friends It is not like I have any pull over Microsoft and can make them change anything here, that would be your task. In the meantime, just toggle between “safe/gamer” and “risky/developer” mode with a 2nd boot option, a real multiboot, a virtual, a second machine….any of those tools that are a minor inconvenience and would fulfil at least part of your needs (that I don’t seem to care about yet continuously seem to mention improvements for) [/q]

[q]But would you at least be able to admit that MS could handle it better if it wanted to?

I actually did admit that MS could handle it better and asked you if you had talked with them about your ideas.
2016-07-25 9:08 pm

Alfman verbose=1
avgalen,

…but then you loose the signed driver benefit and have to use that 1 command up there. Not perfect, but just a minor inconvenience [/q]

To me it seems absolutely pathetic to keep insisting testmode and rebooting are a viable solution for everyone. If it wasn’t obvious, people like me write drivers because we want to increase the utility of our computers for us, be it custom file systems, low latency audio processing, high performance crypto modules, new virtualization tech, whatever we can think of. Seriously do you know how stupid it is to force us to reboot between kernel modes to experience this utility on and off? In your head it’s just a minor inconvenience, but it doesn’t seem like you’ve ever had to suffer the implications of it. In reality it becomes a pain in the ass. “I have to reboot and loose all my windows to enable my driver.” “Sorry son, you can’t play your steam games now, we need to reboot the computer.” “Sorry wife, I had to close down your login session because I wanted to do homebrew.” “Why isn’t high def working? Oh crap, hold on guys I forgot to reboot before that works.”

We don’t have to look very far to see that normal people hate rebooting even just for the occasional update, they wouldn’t be very tolerant of the solution that you are asking me to accept.

http://superuser.com/questions/189806/disable-auto-restart-prompt-a…

And now I have to configure all my computers to be in testmode and suffer the headaches above to run my own drivers? And this is a viable permanent solution? Forget it! I should not be a second class citizen on my own computer. I’d rather give up writing windows drivers entirely than be subjected to these crappy restrictions, which is what I’ve done.

If you don’t have a problem with microsoft’s control, then I’m happy for you and I won’t question your decision. But I made the right call for me, and it was not made of of ignorance.

I thought nobody’s arguing against the benefits. So it helps the > 99% of users.

You keep on objecting that I’m a minority as though I’ve been asking for something that would lessen benefits to the majority, but I have not. The ideal solution for everyone would have been easy: defaults left as is for 99%, but allow owners to manage their own certificates if they need to (just like every option in windows). There are many ways accomplish this, heck they could incorporate it into the bcdedit tool just like testmode itself and let us select them on boot.

[q]I actually did admit that MS could handle it better and asked you if you had talked with them about your ideas.

Not only didn’t microsoft do this, they banned tools that did. Since then they’ve become even less neutral with windows 8 by adding restrictions in userspace too. IMHO things are getting worse on that ship rather than better.

Edited 2016-07-25 21:26 UTC
2016-07-26 11:33 am

avgalen
Listen, your beef is with Microsoft, not with me. I am only trying to help. If you want to do kernel level development on a shared box you didn’t have to use a certificate but since Vista/7 on 64bit you have to. That is just the way it is. Now if you don’t like that: Take it up with Microsoft and discuss your alternative idea.

I understand that you would like to run your own code on your own computers and it sucks that there are disadvantages to that, but they CAN be sidestepped. Ever heard of DSEFix (still seems to work: http://www.unknowncheats.me/forum/dayz-sa/140652-dsefix-disable-dse…). Or just get a certificate?

But in general you shouldn’t let your mom run a Windows Insider build (I learned this the hard way), and you shouldn’t let your child be gaming on a machine with modified drivers. We know that Windows is not a great platform of this kind of tweaking while still expecting everything else to work normally.

I am the victim of a similar limitation by Microsoft. I started to use Native Boot (booting from a VHD-file without using virtualization) in the Windows 8 era when the “you cannot upgrade an OS that is installed in a VHD” limitation wasn’t documented yet. Upgrading to 8.1 required a hack (upgrading the VHD in HyperV) and upgrading to 10 required that hack again, but that was supposed to be the final version…and then 1511 and 1607 came and require an upgrade procedure for an update. This means my whole company, 50-100 laptops, rely on this hack to receive upgrades and now even some updates. So I know what it is like to be a minority….you just have to keep finding the right people inside Microsoft and try to convince them of a hack/workaround. It seems that after years I have finally been able to do that and 1607 should be my last painful upgrade.

These are the negatives of closed source, outside controlled software. The positives so greatly outweigh these negatives that I just accept and adapt to it.
2016-07-26 2:57 pm

Alfman verbose=1
avgalan,

Listen, your beef is with Microsoft, not with me. I am only trying to help… [/q]

That’s fine, maybe I misread the motivation behind your posts, but telling me about test mode features I’ve already known about for a very long time doesn’t actually help me. Anyways it doesn’t much matter now since I’m out of that game

I understand that you would like to run your own code on your own computers and it sucks that there are disadvantages to that, but they CAN be sidestepped. Ever heard of DSEFix

That’s true, but as a developer I want to be able to use legitimate & supported tools and not have to rely on hacks that can break at any moment. Even the home page says “Main disadvantage of DSEFix is that on the modern version of Windows (8+) g_CiOptions variable is subject of PatchGuard (KPP) protection, which mean DSEFix is a potential BSOD-generator.”.

Or just get a certificate?

Yes, that’s the cleanest way around microsoft’s restrictions. At the time of my project, individuals weren’t even permitted to buy one at all, but at least that’s changed now:

http://blog.certs4less.com/verisign-and-thawte-introduce-individual…

Still for someone who just wants to work on his own code or tweak some open source driver it’s a bit ridiculous to pay a yearly fee costing as much as the OS itself just to be able to run your own code on your own machines. Each developer is supposed to have their own, you aren’t allowed to share certificates and they may be revoked if you are caught doing it. This isn’t viable for FOSS projects wanting to encourage public involvement.

[q]But in general you shouldn’t let your mom run a Windows Insider build (I learned this the hard way), and you shouldn’t let your child be gaming on a machine with modified drivers. We know that Windows is not a great platform of this kind of tweaking while still expecting everything else to work normally.

IMHO that’s a very short sighted view, I want to encourage my kids to understand that that technology is not some kind of black magic. No, it’s people like me who program it and make it useful. Rather than being shamed and shielding them from internals, I think we should be exposing them to it. That’s how kids of my generation learned, and I was very fortunate that the internals were accessible in my time. These days mainstream platforms are all about taking away control, which I find to be a shame. And at least I know what my code does, which is more than anyone can say about the signed code shipping out of microsoft.

It doesn’t seem like there’s much possibility of agreement here, so let’s agree to disagree.

Edited 2016-07-26 15:15 UTC

2016-07-22 7:34 am

billziss
Hi. Just to clarify that the installer available at http://www.secfs.net/winfsp/download/ contains a signed driver. You do not need to enable testsigning on Windows in order to run it.

2016-07-22 7:49 am

avgalen
Post likes these …. cannot upvote anymore…. Thumbs up anyway!

2016-07-21 10:02 pm

Pro-Competition
This sounds like it would go well with ReactOS.