Monday 12 March 2018

Understanding VFS (Virtual File System), inodes and thier role

VFS (Virutal File System)

The virtual file system manages all of the real filesystems mounted at a given time for example xfs, ext4 etc. Each file system registers itself with the VFS during initialization. Each real file system either requires support built directly into the kernel or in the form or modules.

Each filesystem mounted by the VFS has a corrosponding superblock (that is a VFS superblock - not an EXT3 superblock - they are similar in nature however distinct.) A VFS superblock contains the following information:

- Device (e.g. /dev/sda1)
- Inode Pointers (The mounted inode pointers points to the first inode on the filesystem)
- Block size of the filesystem
- Superblock operations (A pointer to a set of superblock routines for this file system)
- File system type (A pointer to the mounted file system's file_system_type  data structure e.g. XFS)
- File system specific (A pointer to information needed by this file system)

VFS inodes

Inodes are used to describe each file system object on a systems - for example a folder or directory. They consist of the following information:

- File Size
- File Type (e.g. regular file, directory, block device etc.)
- Group
- Number of links
- Permissions
- File Access / Modify and Change times
- Extended Attributes
- ACL's

Each inode is identified by a unique inode number - for example we can inspect the inode information about '/etc/passwd' with the stat command:

>> stat /etc/passwd
File: ‘/etc/passwd’
Size: 1578            Blocks: 8          IO Block: 4096   regular file
Device: ca01h/51713d    Inode: 18082       Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Context: system_u:object_r:passwd_file_t:s0
Access: 2018-03-12 11:46:01.201484317 +0000
Modify: 2017-01-19 11:45:27.790745205 +0000
Change: 2017-01-19 11:45:27.793745185 +0000

It's also important to realise that the inode itself does not hold any data - it's purely used for descriptive purposes. 

We can delete a file system object directly with it's assosiated inode number - for example:

cd / && find . -inum 18082 -exec rm -i {} \;

Note: inodes in VFS are different from that of filesystems such as ext2, ext3 etc. An inode within the VFS can be referencing a file situated on one  several different file systems.


Post a Comment