CODEWITHSUNDEEP
windowsfileapifilesystemskernel
oleksii
oleksii

Reputation: 35925

Why isn't copy operation implemented in kernel?

It's my understanding that most file IO operations are implemented in the kernel, such as CRUD, move or remove. However file copy is not implemented as a kernel level API.

In order to detect a file copy in the kernel one will need to use heuristics approach (discussion on this approach), e.g. as detect file reads, file creates and file writes from the same user with the same file name, but different paths.

Why copy is a user land operation?

Upvotes: 0

Views: 288

Answers (1)

Andrew Henle
Andrew Henle

Reputation: 1

First, because caring about whether or not two different files have the same content, where one file's content is copied directly from the other, is a user-space concern that has no logical reason to exist inside a kernel.

At best.

Bytes are bytes.

Second, how would the kernel distinguish copying a file between what are just two different file descriptors? See the man page for sendfile(). Why should the kernel track if the calling user called sendfile() to send the contents of a file to a TCP socket to who-knows-where or to another file?

Third, even if the kernel tracked copying a file, what on God's good Earth would it do with such data?

If you care about such file copy events, set up auditing.

Upvotes: 1

Related Questions