{"id":31333,"date":"2019-10-31T21:40:44","date_gmt":"2019-10-31T18:40:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/virtualnye-fajlovye-sistemy-v-linux-zachem-oni-nuzhny-i-kak-oni-rabotayut-chast-2\/"},"modified":"2019-10-31T21:40:44","modified_gmt":"2019-10-31T18:40:44","slug":"virtualnye-fajlovye-sistemy-v-linux-zachem-oni-nuzhny-i-kak-oni-rabotayut-chast-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/virtualnye-fajlovye-sistemy-v-linux-zachem-oni-nuzhny-i-kak-oni-rabotayut-chast-2","title":{"rendered":"Virtual file systems in Linux: why they are needed and how they work? Part 2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Hello everyone, we are sharing with you the second part of the publication \"Virtual File Systems in Linux: Why They Are Needed and How They Work?\" The first part can be read here<\/a><\/noindex>. Let us remind you that this series of publications is dedicated to the launch of a new stream for the course Linux Administrator<\/a><\/noindex>, which starts very soon.<\/p>\n

How to Observe VFS Using eBPF and bcc Tools<\/b><\/p>\n

The simplest way to understand how the kernel operates with files sysfs<\/code> is to observe it in practice, and the easiest way to monitor ARM64 is to use eBPF. eBPF (short for Berkeley Packet Filter) consists of a virtual machine running in the kernel<\/a><\/noindex>, which privileged users can request (query<\/code>) from the command line. The kernel source informs the reader about what the kernel can do; running eBPF tools on a loaded system shows what the kernel actually does. <\/p>\n

\"Virtual<\/a><\/noindex><\/p>\n

Fortunately, it is easy to start using eBPF with tools bcc<\/a><\/noindex>, which are available as packages from the general distribution Linux<\/a><\/noindex> and are well documented by Bernard Greg.<\/a><\/noindex>The tools bcc<\/code> are Python scripts with small C code inserts, meaning anyone familiar with both languages can easily modify them. In bcc\/tools<\/code> there are 80 Python scripts, so it is likely that a developer or system administrator will find something suitable for solving their task.
\nTo get at least a superficial understanding of what role VFS plays in a running system, try vfscount<\/code> or vfsstat.<\/code>This will show, for instance, that dozens of calls to vfs_open()<\/code> and \"its friends\" occur literally every second.<\/p>\n

\"Virtual
\n<\/p>\n

vfsstat.py<\/code> is a Python script with C code inserts that simply counts VFS function calls.<\/p><\/blockquote>\n

Let's provide a more trivial example and see what happens when we insert a USB flash drive into a computer and the system detects it.<\/p>\n

\"Virtual
\n<\/p>\n

With eBPF you can see what happens in \/sys<\/code>, when a USB flash drive is inserted. Here is a simple and a complex example.<\/p><\/blockquote>\n

In the example shown above, bcc<\/code> tool trace.py<\/a><\/noindex> outputs a message when the command sysfs_create_files()<\/code>is executed. We can see that sysfs_create_files()<\/code> it was triggered by kworker<\/code> thread in response to the flash drive being inserted, but what file was created? The second example demonstrates the full power of eBPF. Here trace.py<\/code> outputs a kernel backtrace (option -K) and the name of the created file sysfs_create_files()<\/code>. The insertion in single quotes is C code that includes an easily recognizable format string, provided by a Python script that runs LLVM just-in-time compiler<\/i>. This string is compiled and executed in a virtual machine within the kernel. The full signature of the function sysfs_create_files ()<\/code> must be replicated in the second command so that the format string can reference one of the parameters. Errors in this C code fragment lead to recognizable C compiler errors. For example, if the -l parameter is missing, you will see \"Failed to compile BPF text.\" Developers who are well-acquainted with C and Python will find the tools bcc<\/code> easy to extend and modify.<\/p>\n

When a USB drive is inserted, the kernel backtrace will show that PID 7711 is the thread kworker<\/code>, which created the file \"events\"<\/code> downward API support (simultaneously with this in sysfs<\/code>. Accordingly, the call to sysfs_remove_files()<\/code> will show that removing the drive resulted in the deletion of the file events<\/code>, which corresponds to the general concept of reference counting. In this process, viewing sysfs_create_link ()<\/code> with eBPF during USB drive insertion will indicate that at least 48 symbolic links were created.<\/p>\n

So what is the purpose of the events file? Using cscope<\/a><\/noindex> to search for __device_add_disk()<\/a><\/noindex>, shows that it calls disk_add_events ()<\/code>, and either \"media_change\"<\/code>, or \"eject_request\"<\/code> may be written to the events file. Here, the kernel block layer informs userspace of the insertion and ejection of the 'disk'. Note how informative this method of investigation is when inserting a USB drive compared to trying to figure out how everything works solely from the sources.<\/p>\n

Read-only root file systems enable embedded devices<\/b><\/p>\n

Of course, no one turns off the server or their computer by pulling the plug out of the wall. But why? It's because mounted file systems on physical storage devices may have pending writes, and the data structures recording their state may not synchronize with the records in storage. When this happens, system owners must wait for the next boot to run the fsck filesystem-recovery<\/code> utility and, in the worst case, lose data. <\/p>\n

However, we all know that many IoT devices, as well as routers, thermostats, and cars, now operate under Linux. Many of these devices have virtually no user interface, and there is no way to turn them off 'cleanly'. Imagine starting a car with a dead battery when the power to the control unit is constantly fluctuating. Linux<\/a><\/noindex> How does it happen that the system boots up without a long delay, fsck<\/code>when the engine finally starts running? The answer is simple. Embedded devices rely on a root file system, read-only<\/a><\/noindex> (shortened to ro-rootfs<\/code> (read-only root filesystem). <\/p>\n

ro-rootfs<\/code> These offer numerous advantages that are less obvious than authenticity. One benefit is that malware cannot write to \/usr<\/code> or \/lib<\/code>, if no Linux process can write to it. Another is that a largely immutable file system is critical for field support of remote devices, as support staff use local systems that are nominally identical to the systems in the field. Perhaps the most important (but also the trickiest) advantage is that ro-rootfs forces developers to decide which system objects will be immutable early in the system design phase. Working with ro-rootfs can be inconvenient and painful, much like dealing with const variables in programming languages, but their benefits easily outweigh the additional overhead.<\/p>\n

Creating rootfs<\/code> Read-only file systems require some additional effort from embedded systems developers, and this is where VFS comes into play. Linux requires that files in \/var<\/code> be writable, and moreover, many popular applications that run embedded systems will try to create configuration dot-files.<\/code> downward API support (simultaneously with this in $HOME<\/code>One solution for configuration files in the home directory is usually their pre-generation and assembly into rootfs<\/code>. For \/var<\/code> One possible approach is to mount it in a separate writable partition, while \/<\/code> itself is mounted read-only. Another popular alternative is to use bind or overlay mounts.<\/p>\n

Bind and overlay mounts, using them with containers<\/b> <\/p>\n

Executing the command man mount<\/code> \u2013 is the best way to learn about bind and overlay mounts that allow developers and system administrators to create a file system at one path and then provide it to applications at another. For embedded systems, this means the ability to store files on \/var<\/code> a read-only flash drive, but overlaying or binding a path from tmpfs<\/code> downward API support (simultaneously with this in \/var<\/code> at boot will allow applications to write there (scrawl). The next time it is powered on, changes in \/var<\/code> will be lost. An overlay mount creates a union between tmpfs<\/code> and the underlying file system and allows you to make apparent changes to existing files in ro-tootf<\/code> whereas a bind mount can make new empty tmpfs<\/code> directories visible as writable in ro-rootfs<\/code> paths. While overlayfs<\/code> is the correct (proper<\/code>) type of file system, bind mounting is implemented in the VFS namespace<\/a><\/noindex>.<\/p>\n

Based on the description of overlay and bind mounting, it's no surprise that Linux containers<\/a><\/noindex> actively use them. Let's observe what happens when we use systemd-nspawn<\/a><\/noindex> to run a container, using the tool mountsnoop<\/code> from bcc<\/code>.<\/p>\n

Call system-nspawn<\/code> starts the container during the operation mountsnoop.py<\/code>.<\/p>\n

Let's see what we got:<\/p>\n

Start mountsnoop<\/code> during the container's 'boot' shows that the container runtime environment heavily relies on bind mounting (Only the start of a long output is displayed).<\/p>\n

Here systemd-nspawn<\/code> provides selected files from Functions<\/code> and sysfs<\/code> the host into the container as paths in its rootfs<\/code>. In addition to the MS_BIND<\/code> flag, which sets the bind mount, some other flags in the mounting system define the relationship between changes in the host's namespace and the container. For example, a bind mount can either pass changes into \/proc<\/code> and \/sys<\/code> the container, or hide them depending on the call. <\/p>\n

Conclusion<\/b><\/p>\n

Understanding the inner workings of Linux may seem like an impossible task, as the kernel itself contains a massive amount of code, not to mention the user space Linux applications and system call interfaces in C language libraries, such as glibc<\/code>. One way to make progress is to read the source code of a kernel subsystem, focusing on understanding system calls and headers addressed to user space, as well as key internal kernel interfaces, for instance, the table file_operations<\/code>. File operations adhere to the principle of \"everything is a file,\" making their management particularly enjoyable. The core source files written in C are located in the top-level directory fs\/<\/code> and represent the implementation of virtual file systems, which act as a shell layer providing broad and relatively straightforward compatibility for popular file systems and storage devices. Mounting through binding and overlaying via Linux namespaces is the magic of VFS, enabling the creation of containers and read-only root file systems. Combined with studying the source code, the eBPF core tool and its interface bcc<\/code>
\n make exploring the kernel easier than ever.<\/p>\n

Friends, did you find this article useful? Perhaps you have some comments or suggestions? For those interested in the \"Linux Administrator\" course, we invite you to open house<\/a><\/noindex>, which will take place on April 18.<\/p>\n

Part one.<\/a><\/noindex>
\n
Source: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442, \u0434\u0435\u043b\u0438\u043c\u0441\u044f \u0441 \u0432\u0430\u043c\u0438 \u0432\u0442\u043e\u0440\u043e\u0439 \u0447\u0430\u0441\u0442\u044c\u044e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u00ab\u0412\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432 Linux: \u0437\u0430\u0447\u0435\u043c \u043e\u043d\u0438 \u043d\u0443\u0436\u043d\u044b \u0438 \u043a\u0430\u043a \u043e\u043d\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442?\u00bb \u041f\u0435\u0440\u0432\u0443\u044e \u0447\u0430\u0441\u0442\u044c \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0442\u0443\u0442. \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, \u0434\u0430\u043d\u043d\u0430\u044f \u0441\u0435\u0440\u0438\u044f \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0439 \u043f\u0440\u0438\u0443\u0440\u043e\u0447\u0435\u043d\u0430 \u043a \u0437\u0430\u043f\u0443\u0441\u043a\u0443 \u043d\u043e\u0432\u043e\u0433\u043e \u043f\u043e\u0442\u043e\u043a\u0430 \u043f\u043e \u043a\u0443\u0440\u0441\u0443 \u00ab\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Linux\u00bb, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u0442\u0430\u0440\u0442\u0443\u0435\u0442 \u0443\u0436\u0435 \u0441\u043e\u0432\u0441\u0435\u043c \u0441\u043a\u043e\u0440\u043e. \u041a\u0430\u043a \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0442\u044c \u0437\u0430 VFS \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 eBPF \u0438 bcc \u0421\u0430\u043c\u044b\u0439 \u043f\u0440\u043e\u0441\u0442\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23299,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31333","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Virtual File Systems in Linux: What Are They and How Do They Work? Part 2 | ProHoster","description":"Hello everyone, we are sharing with you the second part of the publication \"Virtual File Systems in Linux: Why They Are Needed and How They Work?\" The first part can be read","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/virtualnye-fajlovye-sistemy-v-linux-zachem-oni-nuzhny-i-kak-oni-rabotayut-chast-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432 Linux: \u0437\u0430\u0447\u0435\u043c \u043e\u043d\u0438 \u043d\u0443\u0436\u043d\u044b \u0438 \u043a\u0430\u043a \u043e\u043d\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442? \u0427\u0430\u0441\u0442\u044c 2 | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442, \u0434\u0435\u043b\u0438\u043c\u0441\u044f \u0441 \u0432\u0430\u043c\u0438 \u0432\u0442\u043e\u0440\u043e\u0439 \u0447\u0430\u0441\u0442\u044c\u044e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u00ab\u0412\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u043e\u0432\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432 Linux: \u0437\u0430\u0447\u0435\u043c \u043e\u043d\u0438 \u043d\u0443\u0436\u043d\u044b \u0438 \u043a\u0430\u043a \u043e\u043d\u0438 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442?\u00bb \u041f\u0435\u0440\u0432\u0443\u044e \u0447\u0430\u0441\u0442\u044c \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/virtualnye-fajlovye-sistemy-v-linux-zachem-oni-nuzhny-i-kak-oni-rabotayut-chast-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:40:44+00:00","article:modified_time":"2019-10-31T18:40:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31333","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 05:41:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:18:40","updated":"2026-01-21 05:41:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/31333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=31333"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/31333\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/23299"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=31333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=31333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=31333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}